diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix
index e5699161ec4bc..3efadea823552 100644
--- a/nixos/modules/config/no-x-libs.nix
+++ b/nixos/modules/config/no-x-libs.nix
@@ -45,6 +45,7 @@ with lib;
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
       pinentry = super.pinentry.override { enabledFlavors = [ "curses" "tty" "emacs" ]; withLibsecret = false; };
       qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
+      qrencode = super.qrencode.overrideAttrs (_: { doCheck = false; });
       zbar = super.zbar.override { enableVideo = false; withXorg = false; };
     }));
   };
diff --git a/pkgs/applications/misc/gv/default.nix b/pkgs/applications/misc/gv/default.nix
index d5aa1ac88179c..ca12e3bc77a9c 100644
--- a/pkgs/applications/misc/gv/default.nix
+++ b/pkgs/applications/misc/gv/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, Xaw3d, ghostscriptX, perl, pkg-config, libiconv }:
+{ lib, stdenv, fetchurl, libXext, Xaw3d, ghostscriptX, perl, pkg-config, libiconv }:
 
 stdenv.mkDerivation rec {
   pname = "gv";
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
+    libXext
     Xaw3d
     ghostscriptX
     perl
diff --git a/pkgs/applications/misc/jekyll/basic/Gemfile.lock b/pkgs/applications/misc/jekyll/basic/Gemfile.lock
index 19cc2a7faef7d..5fc41261bbf75 100644
--- a/pkgs/applications/misc/jekyll/basic/Gemfile.lock
+++ b/pkgs/applications/misc/jekyll/basic/Gemfile.lock
@@ -101,4 +101,4 @@ DEPENDENCIES
   jemoji
 
 BUNDLED WITH
-   2.3.25
+   2.3.9
diff --git a/pkgs/applications/misc/jekyll/full/Gemfile b/pkgs/applications/misc/jekyll/full/Gemfile
index 2e72350f7e5e7..5e7e2d9032a37 100644
--- a/pkgs/applications/misc/jekyll/full/Gemfile
+++ b/pkgs/applications/misc/jekyll/full/Gemfile
@@ -11,6 +11,7 @@ gem "jemoji"
 # Optional dependencies:
 gem "jekyll-coffeescript"
 #gem "jekyll-docs"
+gem "jekyll-favicon"
 gem "jekyll-feed", "~> 0.9"
 gem "jekyll-gist"
 gem "jekyll-paginate"
diff --git a/pkgs/applications/misc/jekyll/full/Gemfile.lock b/pkgs/applications/misc/jekyll/full/Gemfile.lock
index 8d9fbb696d7ec..6b1cc609e080f 100644
--- a/pkgs/applications/misc/jekyll/full/Gemfile.lock
+++ b/pkgs/applications/misc/jekyll/full/Gemfile.lock
@@ -58,6 +58,10 @@ GEM
     jekyll-coffeescript (2.0.0)
       coffee-script (~> 2.2)
       coffee-script-source (~> 1.12)
+    jekyll-favicon (1.1.0)
+      jekyll (>= 3.0, < 5.0)
+      mini_magick (~> 4.11)
+      rexml (~> 3.2, >= 3.2.5)
     jekyll-feed (0.17.0)
       jekyll (>= 3.7, < 5.0)
     jekyll-gist (1.5.0)
@@ -100,6 +104,7 @@ GEM
     mime-types (3.4.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2022.0105)
+    mini_magick (4.11.0)
     mini_portile2 (2.8.0)
     minitest (5.16.3)
     nokogiri (1.13.9)
@@ -146,6 +151,7 @@ DEPENDENCIES
   jekyll
   jekyll-avatar
   jekyll-coffeescript
+  jekyll-favicon
   jekyll-feed (~> 0.9)
   jekyll-gist
   jekyll-mentions
@@ -163,4 +169,4 @@ DEPENDENCIES
   yajl-ruby (~> 1.4)
 
 BUNDLED WITH
-   2.3.25
+   2.3.9
diff --git a/pkgs/applications/misc/jekyll/full/gemset.nix b/pkgs/applications/misc/jekyll/full/gemset.nix
index 334750398ff78..3607b507cd9d4 100644
--- a/pkgs/applications/misc/jekyll/full/gemset.nix
+++ b/pkgs/applications/misc/jekyll/full/gemset.nix
@@ -264,6 +264,17 @@
     };
     version = "2.0.0";
   };
+  jekyll-favicon = {
+    dependencies = ["jekyll" "mini_magick" "rexml"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dyksm4i11n0qshd7wh6dvk8d0fc70dd32ir2dxs6igxq0gd6hi1";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
   jekyll-feed = {
     dependencies = ["jekyll"];
     groups = ["default"];
@@ -526,6 +537,16 @@
     };
     version = "3.2022.0105";
   };
+  mini_magick = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1aj604x11d9pksbljh0l38f70b558rhdgji1s9i763hiagvvx2hs";
+      type = "gem";
+    };
+    version = "4.11.0";
+  };
   mini_portile2 = {
     groups = ["default"];
     platforms = [];
diff --git a/pkgs/applications/science/engineering/strictdoc/default.nix b/pkgs/applications/science/engineering/strictdoc/default.nix
index 3fc61b8451567..ce834f7d576bd 100644
--- a/pkgs/applications/science/engineering/strictdoc/default.nix
+++ b/pkgs/applications/science/engineering/strictdoc/default.nix
@@ -3,14 +3,12 @@
 , buildPythonApplication
 , fetchFromGitHub
 , python3
-, pythonOlder
 , html5lib
 , invoke
 , openpyxl
 , poetry-core
 , tidylib
 , beautifulsoup4
-, dataclasses
 , datauri
 , docutils
 , jinja2
@@ -73,8 +71,6 @@ buildPythonApplication rec {
     textx
     xlrd
     XlsxWriter
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ];
 
   checkInputs = [
diff --git a/pkgs/applications/virtualization/docker/compose_1.nix b/pkgs/applications/virtualization/docker/compose_1.nix
index 1299d6f69ec79..425363e2b73b6 100644
--- a/pkgs/applications/virtualization/docker/compose_1.nix
+++ b/pkgs/applications/virtualization/docker/compose_1.nix
@@ -1,7 +1,7 @@
 { lib, buildPythonApplication, fetchPypi, pythonOlder
 , installShellFiles
 , mock, pytest, nose
-, pyyaml, backports_ssl_match_hostname, colorama, docopt
+, pyyaml, colorama, docopt
 , dockerpty, docker, jsonschema, requests
 , six, texttable, websocket-client, cached-property
 , enum34, functools32, paramiko, distro, python-dotenv
@@ -24,7 +24,7 @@ buildPythonApplication rec {
     pyyaml colorama dockerpty docker
     jsonschema requests six texttable websocket-client
     docopt cached-property paramiko distro python-dotenv
-  ] ++ lib.optional (pythonOlder "3.7") backports_ssl_match_hostname
+  ]
   ++ lib.optional (pythonOlder "3.4") enum34
   ++ lib.optional (pythonOlder "3.2") functools32;
 
diff --git a/pkgs/applications/window-managers/notion/default.nix b/pkgs/applications/window-managers/notion/default.nix
index 4e546c0671556..d4ae41134ebcc 100644
--- a/pkgs/applications/window-managers/notion/default.nix
+++ b/pkgs/applications/window-managers/notion/default.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
     sha256 = "14swd0yqci8lxn259fkd9w92bgyf4rmjwgvgyqp78wlfix6ai4mv";
   };
 
+  # error: 'PATH_MAX' undeclared
+  postPatch = ''
+    sed 1i'#include <linux/limits.h>' -i mod_notionflux/notionflux/notionflux.c
+  '';
+
   nativeBuildInputs = [ pkg-config makeWrapper groff ];
   buildInputs = [ lua gettext which readline fontconfig libX11 libXext libSM
                   libXinerama libXrandr libXft ];
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index b54983986dbee..121b50fe0f523 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -167,7 +167,8 @@ stdenv.mkDerivation {
 
     # Create symlinks for rest of the binaries.
     + ''
-      for binary in objdump objcopy size strings as ar nm gprof dwp c++filt addr2line ranlib readelf elfedit; do
+      for binary in objdump objcopy size strings as ar nm gprof dwp c++filt addr2line \
+          ranlib readelf elfedit dlltool dllwrap windmc windres; do
         if [ -e $ldPath/${targetPrefix}''${binary} ]; then
           ln -s $ldPath/${targetPrefix}''${binary} $out/bin/${targetPrefix}''${binary}
         fi
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 84d9023209d3d..647f2a2f7adcf 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -209,7 +209,7 @@ let
         flags+=($buildFlags "''${buildFlagsArray[@]}")
         flags+=(''${tags:+-tags=${lib.concatStringsSep "," tags}})
         flags+=(''${ldflags:+-ldflags="$ldflags"})
-        flags+=("-v" "-p" "$NIX_BUILD_CORES")
+        flags+=("-p" "$NIX_BUILD_CORES")
 
         if [ "$cmd" = "test" ]; then
           flags+=(-vet=off)
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index 957a65572b850..ba1ab37a0c0eb 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -168,7 +168,7 @@ let
         flags+=($buildFlags "''${buildFlagsArray[@]}")
         flags+=(''${tags:+-tags=${lib.concatStringsSep "," tags}})
         flags+=(''${ldflags:+-ldflags="$ldflags"})
-        flags+=("-v" "-p" "$NIX_BUILD_CORES")
+        flags+=("-p" "$NIX_BUILD_CORES")
 
         if [ "$cmd" = "test" ]; then
           flags+=(-vet=off)
diff --git a/pkgs/build-support/wrapper-common/utils.bash b/pkgs/build-support/wrapper-common/utils.bash
index 0afccadf3384e..44b44818c8ed9 100644
--- a/pkgs/build-support/wrapper-common/utils.bash
+++ b/pkgs/build-support/wrapper-common/utils.bash
@@ -104,13 +104,13 @@ badPath() {
     # directory (including the build directory).
     test \
         "$p" != "/dev/null" -a \
-        "${p#${NIX_STORE}}"     = "$p" -a \
-        "${p#${NIX_BUILD_TOP}}" = "$p" -a \
-        "${p#/tmp}"             = "$p" -a \
-        "${p#${TMP:-/tmp}}"     = "$p" -a \
-        "${p#${TMPDIR:-/tmp}}"  = "$p" -a \
-        "${p#${TEMP:-/tmp}}"    = "$p" -a \
-        "${p#${TEMPDIR:-/tmp}}" = "$p"
+        "${p#"${NIX_STORE}"}"     = "$p" -a \
+        "${p#"${NIX_BUILD_TOP}"}" = "$p" -a \
+        "${p#/tmp}"               = "$p" -a \
+        "${p#"${TMP:-/tmp}"}"     = "$p" -a \
+        "${p#"${TMPDIR:-/tmp}"}"  = "$p" -a \
+        "${p#"${TEMP:-/tmp}"}"    = "$p" -a \
+        "${p#"${TEMPDIR:-/tmp}"}" = "$p"
 }
 
 expandResponseParams() {
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index a4739edea12fb..2ae33c049bd22 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -17,10 +17,20 @@
 }:
 
 let
-  blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
+  blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" (blacklist ++ [
+    # Mozilla does not trust new certificates issued by these CAs after 2022/11/30¹
+    # in their products, but unfortunately we don't have such a fine-grained
+    # solution for most system packages², so we decided to eject these.
+    #
+    # [1] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
+    # [2] https://utcc.utoronto.ca/~cks/space/blog/linux/CARootStoreTrustProblem
+    "TrustCor ECA-1"
+    "TrustCor RootCert CA-1"
+    "TrustCor RootCert CA-2"
+  ]));
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.83";
+  srcVersion = "3.86";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -35,7 +45,7 @@ let
 
     src = if nssOverride != null then nssOverride.src else fetchurl {
       url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      sha256 = "sha256-qyPqZ/lkCQuLc8gKZ0CCVxw25fTrqSBXrGSMnB3vASg=";
+      sha256 = "sha256-PzhfxoZHa7uoEQNfpoIbVCR11VdHsYwgwiHU1mVzuXU=";
     };
 
     dontBuild = true;
diff --git a/pkgs/data/misc/mobile-broadband-provider-info/default.nix b/pkgs/data/misc/mobile-broadband-provider-info/default.nix
index 85f45ec516dfa..104ec58f718f6 100644
--- a/pkgs/data/misc/mobile-broadband-provider-info/default.nix
+++ b/pkgs/data/misc/mobile-broadband-provider-info/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mobile-broadband-provider-info";
-  version = "20220725";
+  version = "20221107";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-SEWuAcKH8t+wIrxi1ZoUiHP/xKZz9RAgViZXQm1jKs0=";
+    sha256 = "sha256-2TOSVmw0epbu2V2oxmpdoN2U9BFc+zowX/JoLGTP2BA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 1453b3899ef7f..81f23c9a828f0 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -1,17 +1,17 @@
-{ lib, stdenv, fetchurl, fetchpatch, buildPackages }:
+{ lib, stdenv, fetchurl, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2022f";
+  version = "2022g";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-mZDXH2ddISVnuTH+iq4cq3An+J/vuKedgIppM6Z68AA=";
+      hash = "sha256-RJHbgoGulKhNk55Ce92D3DifJnZNJ9mlxS14LBZ2RHg=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-5FQ+kPhPkfqCgJ6piTAFL9vBOIDIpiPuOk6qQvimTBU=";
+      hash = "sha256-lhC7C5ZW/0BMNhpB8yhtpTBktUadhPAMnLIxTIYU2nQ=";
     })
   ];
 
@@ -19,17 +19,6 @@ stdenv.mkDerivation rec {
 
   patches = lib.optionals stdenv.hostPlatform.isWindows [
     ./0001-Add-exe-extension-for-MS-Windows-binaries.patch
-  ] ++ [
-    (fetchpatch {
-      name = "fix-get-random-on-osx-1.patch";
-      url = "https://github.com/eggert/tz/commit/5db8b3ba4816ccb8f4ffeb84f05b99e87d3b1be6.patch";
-      hash = "sha256-FevGjiSahYwEjRUTvRY0Y6/jUO4YHiTlAAPixzEy5hw=";
-    })
-    (fetchpatch {
-      name = "fix-get-random-on-osx-2.patch";
-      url = "https://github.com/eggert/tz/commit/841183210311b1d4ffb4084bfde8fa8bdf3e6757.patch";
-      hash = "sha256-1tUTZBMT7V463P7eygpFS6/k5gTeeXumk5+V4gdKpEI=";
-    })
   ];
 
   outputs = [ "out" "bin" "man" "dev" ];
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index a406b21458dce..28cced9451a7f 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.19.3";
+  version = "1.19.4";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-GKwmPjkhC89o2F9DcOl/sXNBZplaH2P7OLT24H2Q0hI=";
+    sha256 = "sha256-7adNtKxJSACj5m7nhOSVv7ubjlNd+SSosBsagCi382g=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/intel-graphics-compiler/default.nix b/pkgs/development/compilers/intel-graphics-compiler/default.nix
index 0eab971fb977d..0570450b32bf5 100644
--- a/pkgs/development/compilers/intel-graphics-compiler/default.nix
+++ b/pkgs/development/compilers/intel-graphics-compiler/default.nix
@@ -6,7 +6,6 @@
 , bison
 , flex
 , llvmPackages_11
-, lld_11
 , opencl-clang
 , python3
 , spirv-tools
@@ -20,42 +19,40 @@ let
   vc_intrinsics_src = fetchFromGitHub {
     owner = "intel";
     repo = "vc-intrinsics";
-    rev = "v0.3.0";
-    sha256 = "sha256-1Rm4TCERTOcPGWJF+yNoKeB9x3jfqnh7Vlv+0Xpmjbk=";
+    rev = "v0.7.1";
+    sha256 = "sha256-bpi4hLpov1CbFy4jr9Eytc5O4ismYw0J+KgXyZtQYks=";
   };
+
   llvmPkgs = llvmPackages_11 // {
-    inherit spirv-llvm-translator;
-  };
-  inherit (llvmPkgs) llvm;
-  inherit (if buildWithPatches then opencl-clang else llvmPkgs) clang libclang spirv-llvm-translator;
-  inherit (lib) getVersion optional optionals versionOlder versions;
+    spirv-llvm-translator = spirv-llvm-translator.override { llvm = llvm; };
+  } // lib.optionalAttrs buildWithPatches opencl-clang;
+
+  inherit (llvmPackages_11) lld llvm;
+  inherit (llvmPkgs) clang libclang spirv-llvm-translator;
 in
 
 stdenv.mkDerivation rec {
   pname = "intel-graphics-compiler";
-  version = "1.0.11061";
+  version = "1.0.12504.5";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "intel-graphics-compiler";
     rev = "igc-${version}";
-    sha256 = "sha256-qS/+GTqHtp3T6ggPKrCDsrTb7XvVOUaNbMzGU51jTu4=";
+    sha256 = "sha256-Ok+cXMTBABrHHM4Vc2yzlou48YHoQnaB3We8mGZhSwI=";
   };
 
-  nativeBuildInputs = [ clang cmake bison flex python3 ];
+  nativeBuildInputs = [ cmake bison flex python3 ];
 
-  buildInputs = [ spirv-headers spirv-tools clang opencl-clang spirv-llvm-translator llvm lld_11 ];
+  buildInputs = [ spirv-headers spirv-tools spirv-llvm-translator llvm lld ];
 
   strictDeps = true;
 
-  # checkInputs = [ lit pythonPackages.nose ];
-
-  # FIXME: How do we run the test suite?
-  # https://github.com/intel/intel-graphics-compiler/issues/98
+  # testing is done via intel-compute-runtime
   doCheck = false;
 
   postPatch = ''
-    substituteInPlace ./external/SPIRV-Tools/CMakeLists.txt \
+    substituteInPlace external/SPIRV-Tools/CMakeLists.txt \
       --replace '$'''{SPIRV-Tools_DIR}../../..' \
                 '${spirv-tools}' \
       --replace 'SPIRV-Headers_INCLUDE_DIR "/usr/include"' \
@@ -64,7 +61,7 @@ stdenv.mkDerivation rec {
                 'set_target_properties(SPIRV-Tools-shared' \
       --replace 'IGC_BUILD__PROJ__SPIRV-Tools SPIRV-Tools' \
                 'IGC_BUILD__PROJ__SPIRV-Tools SPIRV-Tools-shared'
-    substituteInPlace ./IGC/AdaptorOCL/igc-opencl.pc.in \
+    substituteInPlace IGC/AdaptorOCL/igc-opencl.pc.in \
       --replace '/@CMAKE_INSTALL_INCLUDEDIR@' "/include" \
       --replace '/@CMAKE_INSTALL_LIBDIR@' "/lib"
   '';
@@ -74,10 +71,10 @@ stdenv.mkDerivation rec {
   prebuilds = runCommandLocal "igc-cclang-prebuilds" { } ''
     mkdir $out
     ln -s ${clang}/bin/clang $out/
-    ln -s clang $out/clang-${versions.major (getVersion clang)}
+    ln -s clang $out/clang-${lib.versions.major (lib.getVersion clang)}
     ln -s ${opencl-clang}/lib/* $out/
-    ln -s ${lib.getLib libclang}/lib/clang/${getVersion clang}/include/opencl-c.h $out/
-    ln -s ${lib.getLib libclang}/lib/clang/${getVersion clang}/include/opencl-c-base.h $out/
+    ln -s ${lib.getLib libclang}/lib/clang/${lib.getVersion clang}/include/opencl-c.h $out/
+    ln -s ${lib.getLib libclang}/lib/clang/${lib.getVersion clang}/include/opencl-c-base.h $out/
   '';
 
   cmakeFlags = [
@@ -86,15 +83,14 @@ stdenv.mkDerivation rec {
     "-DIGC_OPTION__SPIRV_TOOLS_MODE=Prebuilds"
     "-DCCLANG_BUILD_PREBUILDS=ON"
     "-DCCLANG_BUILD_PREBUILDS_DIR=${prebuilds}"
-    "-DIGC_PREFERRED_LLVM_VERSION=${getVersion llvm}"
+    "-DIGC_PREFERRED_LLVM_VERSION=${lib.getVersion llvm}"
   ];
 
   meta = with lib; {
     homepage = "https://github.com/intel/intel-graphics-compiler";
     description = "LLVM-based compiler for OpenCL targeting Intel Gen graphics hardware";
     license = licenses.mit;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ gloaming ];
-    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/intel-graphics-compiler.x86_64-darwin
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/development/compilers/sbcl/2.x.nix b/pkgs/development/compilers/sbcl/2.x.nix
index 85b3881e3a153..2d79117b16632 100644
--- a/pkgs/development/compilers/sbcl/2.x.nix
+++ b/pkgs/development/compilers/sbcl/2.x.nix
@@ -57,6 +57,10 @@ let
     "2.2.10" = {
       sha256 = "sha256-jMPDqHYSI63vFEqIcwsmdQg6Oyb6FV1wz5GruTXpCDM=";
     };
+
+    "2.2.11" = {
+      sha256 = "sha256-NgfWgBZzGICEXO1dXVXGBUzEnxkSGhUCfmxWB66Elt8=";
+    };
   };
 
 in with versionMap.${version};
@@ -169,7 +173,9 @@ stdenv.mkDerivation rec {
     #   duplicate symbol '_static_code_space_free_pointer' in: alloc.o traceroot.o
     # Should be fixed past 2.1.10 release.
     "-fcommon"
-  ];
+  ]
+    # Fails to find `O_LARGEFILE` otherwise.
+    ++ [ "-D_GNU_SOURCE" ];
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/development/compilers/spirv-llvm-translator/default.nix b/pkgs/development/compilers/spirv-llvm-translator/default.nix
index 2100c7d9070ad..971b3e8399dfd 100644
--- a/pkgs/development/compilers/spirv-llvm-translator/default.nix
+++ b/pkgs/development/compilers/spirv-llvm-translator/default.nix
@@ -22,11 +22,11 @@ let
       hash = "sha256-BhNAApgZ/w/92XjpoDY6ZEIhSTwgJ4D3/EfNvPmNM2o=";
     } else if llvmMajor == "11" then {
       version = "unstable-2022-05-04";
-      rev = "99420daab98998a7e36858befac9c5ed109d4920"; # 265 commits ahead of v11.0.0
-      hash = "sha256-/vUyL6Wh8hykoGz1QmT1F7lfGDEmG4U3iqmqrJxizOg=";
+      rev = "4ef524240833abfeee1c5b9fff6b1bd53f4806b3"; # 267 commits ahead of v11.0.0
+      hash = "sha256-NoIoa20+2sH41rEnr8lsMhtfesrtdPINiXtUnxYVm8s=";
     } else throw "Incompatible LLVM version.";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "SPIRV-LLVM-Translator";
   inherit (branch) version;
 
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
     homepage    = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator";
     description = "A tool and a library for bi-directional translation between SPIR-V and LLVM IR";
     license     = licenses.ncsa;
-    platforms   = platforms.all;
+    platforms   = platforms.unix;
     maintainers = with maintainers; [ gloaming ];
   };
 }
diff --git a/pkgs/development/interpreters/python/cpython/3.10/asyncio-deprecation.patch b/pkgs/development/interpreters/python/cpython/3.10/asyncio-deprecation.patch
new file mode 100644
index 0000000000000..656e4eb6a4cb3
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.10/asyncio-deprecation.patch
@@ -0,0 +1,598 @@
+REVERT https://github.com/python/cpython/commit/300d812fd1c4d9244e71de0d228cc72439d312a7
+--- b/Doc/library/asyncio-eventloop.rst
++++ a/Doc/library/asyncio-eventloop.rst
+@@ -43,12 +43,10 @@
+ 
+    Get the current event loop.
+ 
++   If there is no current event loop set in the current OS thread,
++   the OS thread is main, and :func:`set_event_loop` has not yet
++   been called, asyncio will create a new event loop and set it as the
++   current one.
+-   When called from a coroutine or a callback (e.g. scheduled with
+-   call_soon or similar API), this function will always return the
+-   running event loop.
+-
+-   If there is no running event loop set, the function will return
+-   the result of ``get_event_loop_policy().get_event_loop()`` call.
+ 
+    Because this function has rather complex behavior (especially
+    when custom event loop policies are in use), using the
+@@ -60,14 +58,10 @@
+    event loop.
+ 
+    .. deprecated:: 3.10
++      Emits a deprecation warning if there is no running event loop.
++      In future Python releases, this function may become an alias of
++      :func:`get_running_loop` and will accordingly raise a
++      :exc:`RuntimeError` if there is no running event loop.
+-      Deprecation warning is emitted if there is no current event loop.
+-      In Python 3.12 it will be an error.
+-
+-   .. note::
+-      In Python versions 3.10.0--3.10.8 this function
+-      (and other functions which used it implicitly) emitted a
+-      :exc:`DeprecationWarning` if there was no running event loop, even if
+-      the current loop was set.
+ 
+ .. function:: set_event_loop(loop)
+ 
+reverted:
+--- b/Doc/library/asyncio-llapi-index.rst
++++ a/Doc/library/asyncio-llapi-index.rst
+@@ -19,7 +19,7 @@
+       - The **preferred** function to get the running event loop.
+ 
+     * - :func:`asyncio.get_event_loop`
++      - Get an event loop instance (current or via the policy).
+-      - Get an event loop instance (running or current via the current policy).
+ 
+     * - :func:`asyncio.set_event_loop`
+       - Set the event loop as current via the current policy.
+reverted:
+--- b/Doc/library/asyncio-policy.rst
++++ a/Doc/library/asyncio-policy.rst
+@@ -112,11 +112,6 @@
+ 
+       On Windows, :class:`ProactorEventLoop` is now used by default.
+ 
+-   .. deprecated:: 3.10.9
+-      :meth:`get_event_loop` now emits a :exc:`DeprecationWarning` if there
+-      is no current event loop set and a new event loop has been implicitly
+-      created. In Python 3.12 it will be an error.
+-
+ 
+ .. class:: WindowsSelectorEventLoopPolicy
+ 
+reverted:
+--- b/Lib/asyncio/events.py
++++ a/Lib/asyncio/events.py
+@@ -650,21 +650,6 @@
+         if (self._local._loop is None and
+                 not self._local._set_called and
+                 threading.current_thread() is threading.main_thread()):
+-            stacklevel = 2
+-            try:
+-                f = sys._getframe(1)
+-            except AttributeError:
+-                pass
+-            else:
+-                while f:
+-                    module = f.f_globals.get('__name__')
+-                    if not (module == 'asyncio' or module.startswith('asyncio.')):
+-                        break
+-                    f = f.f_back
+-                    stacklevel += 1
+-            import warnings
+-            warnings.warn('There is no current event loop',
+-                          DeprecationWarning, stacklevel=stacklevel)
+             self.set_event_loop(self.new_event_loop())
+ 
+         if self._local._loop is None:
+@@ -778,13 +763,12 @@
+ 
+ 
+ def _get_event_loop(stacklevel=3):
+-    # This internal method is going away in Python 3.12, left here only for
+-    # backwards compatibility with 3.10.0 - 3.10.8 and 3.11.0.
+-    # Similarly, this method's C equivalent in _asyncio is going away as well.
+-    # See GH-99949 for more details.
+     current_loop = _get_running_loop()
+     if current_loop is not None:
+         return current_loop
++    import warnings
++    warnings.warn('There is no current event loop',
++                  DeprecationWarning, stacklevel=stacklevel)
+     return get_event_loop_policy().get_event_loop()
+ 
+ 
+reverted:
+--- b/Lib/test/test_asyncio/test_base_events.py
++++ a/Lib/test/test_asyncio/test_base_events.py
+@@ -752,7 +752,7 @@
+     def test_env_var_debug(self):
+         code = '\n'.join((
+             'import asyncio',
++            'loop = asyncio.get_event_loop()',
+-            'loop = asyncio.new_event_loop()',
+             'print(loop.get_debug())'))
+ 
+         # Test with -E to not fail if the unit test was run with
+reverted:
+--- b/Lib/test/test_asyncio/test_events.py
++++ a/Lib/test/test_asyncio/test_events.py
+@@ -2561,9 +2561,8 @@
+     def test_get_event_loop(self):
+         policy = asyncio.DefaultEventLoopPolicy()
+         self.assertIsNone(policy._local._loop)
++
++        loop = policy.get_event_loop()
+-        with self.assertWarns(DeprecationWarning) as cm:
+-            loop = policy.get_event_loop()
+-        self.assertEqual(cm.filename, __file__)
+         self.assertIsInstance(loop, asyncio.AbstractEventLoop)
+ 
+         self.assertIs(policy._local._loop, loop)
+@@ -2577,10 +2576,7 @@
+                 policy, "set_event_loop",
+                 wraps=policy.set_event_loop) as m_set_event_loop:
+ 
++            loop = policy.get_event_loop()
+-            with self.assertWarns(DeprecationWarning) as cm:
+-                loop = policy.get_event_loop()
+-            self.addCleanup(loop.close)
+-            self.assertEqual(cm.filename, __file__)
+ 
+             # policy._local._loop must be set through .set_event_loop()
+             # (the unix DefaultEventLoopPolicy needs this call to attach
+@@ -2614,8 +2610,7 @@
+ 
+     def test_set_event_loop(self):
+         policy = asyncio.DefaultEventLoopPolicy()
++        old_loop = policy.get_event_loop()
+-        old_loop = policy.new_event_loop()
+-        policy.set_event_loop(old_loop)
+ 
+         self.assertRaises(AssertionError, policy.set_event_loop, object())
+ 
+@@ -2728,11 +2723,15 @@
+             asyncio.set_event_loop_policy(Policy())
+             loop = asyncio.new_event_loop()
+ 
++            with self.assertWarns(DeprecationWarning) as cm:
++                with self.assertRaises(TestError):
++                    asyncio.get_event_loop()
++            self.assertEqual(cm.warnings[0].filename, __file__)
+-            with self.assertRaises(TestError):
+-                asyncio.get_event_loop()
+             asyncio.set_event_loop(None)
++            with self.assertWarns(DeprecationWarning) as cm:
++                with self.assertRaises(TestError):
++                    asyncio.get_event_loop()
++            self.assertEqual(cm.warnings[0].filename, __file__)
+-            with self.assertRaises(TestError):
+-                asyncio.get_event_loop()
+ 
+             with self.assertRaisesRegex(RuntimeError, 'no running'):
+                 asyncio.get_running_loop()
+@@ -2746,11 +2745,16 @@
+             loop.run_until_complete(func())
+ 
+             asyncio.set_event_loop(loop)
++            with self.assertWarns(DeprecationWarning) as cm:
++                with self.assertRaises(TestError):
++                    asyncio.get_event_loop()
++            self.assertEqual(cm.warnings[0].filename, __file__)
++
+-            with self.assertRaises(TestError):
+-                asyncio.get_event_loop()
+             asyncio.set_event_loop(None)
++            with self.assertWarns(DeprecationWarning) as cm:
++                with self.assertRaises(TestError):
++                    asyncio.get_event_loop()
++            self.assertEqual(cm.warnings[0].filename, __file__)
+-            with self.assertRaises(TestError):
+-                asyncio.get_event_loop()
+ 
+         finally:
+             asyncio.set_event_loop_policy(old_policy)
+@@ -2774,8 +2778,10 @@
+             self.addCleanup(loop2.close)
+             self.assertEqual(cm.warnings[0].filename, __file__)
+             asyncio.set_event_loop(None)
++            with self.assertWarns(DeprecationWarning) as cm:
++                with self.assertRaisesRegex(RuntimeError, 'no current'):
++                    asyncio.get_event_loop()
++            self.assertEqual(cm.warnings[0].filename, __file__)
+-            with self.assertRaisesRegex(RuntimeError, 'no current'):
+-                asyncio.get_event_loop()
+ 
+             with self.assertRaisesRegex(RuntimeError, 'no running'):
+                 asyncio.get_running_loop()
+@@ -2789,11 +2795,15 @@
+             loop.run_until_complete(func())
+ 
+             asyncio.set_event_loop(loop)
++            with self.assertWarns(DeprecationWarning) as cm:
++                self.assertIs(asyncio.get_event_loop(), loop)
++            self.assertEqual(cm.warnings[0].filename, __file__)
+-            self.assertIs(asyncio.get_event_loop(), loop)
+ 
+             asyncio.set_event_loop(None)
++            with self.assertWarns(DeprecationWarning) as cm:
++                with self.assertRaisesRegex(RuntimeError, 'no current'):
++                    asyncio.get_event_loop()
++            self.assertEqual(cm.warnings[0].filename, __file__)
+-            with self.assertRaisesRegex(RuntimeError, 'no current'):
+-                asyncio.get_event_loop()
+ 
+         finally:
+             asyncio.set_event_loop_policy(old_policy)
+reverted:
+--- b/Lib/test/test_asyncio/test_futures.py
++++ a/Lib/test/test_asyncio/test_futures.py
+@@ -145,8 +145,10 @@
+         self.assertTrue(f.cancelled())
+ 
+     def test_constructor_without_loop(self):
++        with self.assertWarns(DeprecationWarning) as cm:
++            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
++                self._new_future()
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
+-            self._new_future()
+ 
+     def test_constructor_use_running_loop(self):
+         async def test():
+@@ -156,10 +158,12 @@
+         self.assertIs(f.get_loop(), self.loop)
+ 
+     def test_constructor_use_global_loop(self):
++        # Deprecated in 3.10
+-        # Deprecated in 3.10, undeprecated in 3.11.1
+         asyncio.set_event_loop(self.loop)
+         self.addCleanup(asyncio.set_event_loop, None)
++        with self.assertWarns(DeprecationWarning) as cm:
++            f = self._new_future()
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        f = self._new_future()
+         self.assertIs(f._loop, self.loop)
+         self.assertIs(f.get_loop(), self.loop)
+ 
+@@ -495,8 +499,10 @@
+             return (arg, threading.get_ident())
+         ex = concurrent.futures.ThreadPoolExecutor(1)
+         f1 = ex.submit(run, 'oi')
++        with self.assertWarns(DeprecationWarning) as cm:
++            with self.assertRaises(RuntimeError):
++                asyncio.wrap_future(f1)
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
+-            asyncio.wrap_future(f1)
+         ex.shutdown(wait=True)
+ 
+     def test_wrap_future_use_running_loop(self):
+@@ -511,14 +517,16 @@
+         ex.shutdown(wait=True)
+ 
+     def test_wrap_future_use_global_loop(self):
++        # Deprecated in 3.10
+-        # Deprecated in 3.10, undeprecated in 3.11.1
+         asyncio.set_event_loop(self.loop)
+         self.addCleanup(asyncio.set_event_loop, None)
+         def run(arg):
+             return (arg, threading.get_ident())
+         ex = concurrent.futures.ThreadPoolExecutor(1)
+         f1 = ex.submit(run, 'oi')
++        with self.assertWarns(DeprecationWarning) as cm:
++            f2 = asyncio.wrap_future(f1)
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        f2 = asyncio.wrap_future(f1)
+         self.assertIs(self.loop, f2._loop)
+         ex.shutdown(wait=True)
+ 
+reverted:
+--- b/Lib/test/test_asyncio/test_streams.py
++++ a/Lib/test/test_asyncio/test_streams.py
+@@ -747,8 +747,10 @@
+         self.assertEqual(data, b'data')
+ 
+     def test_streamreader_constructor_without_loop(self):
++        with self.assertWarns(DeprecationWarning) as cm:
++            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
++                asyncio.StreamReader()
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
+-            asyncio.StreamReader()
+ 
+     def test_streamreader_constructor_use_running_loop(self):
+         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
+@@ -762,17 +764,21 @@
+     def test_streamreader_constructor_use_global_loop(self):
+         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
+         # retrieves the current loop if the loop parameter is not set
++        # Deprecated in 3.10
+-        # Deprecated in 3.10, undeprecated in 3.11.1
+         self.addCleanup(asyncio.set_event_loop, None)
+         asyncio.set_event_loop(self.loop)
++        with self.assertWarns(DeprecationWarning) as cm:
++            reader = asyncio.StreamReader()
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        reader = asyncio.StreamReader()
+         self.assertIs(reader._loop, self.loop)
+ 
+ 
+     def test_streamreaderprotocol_constructor_without_loop(self):
+         reader = mock.Mock()
++        with self.assertWarns(DeprecationWarning) as cm:
++            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
++                asyncio.StreamReaderProtocol(reader)
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
+-            asyncio.StreamReaderProtocol(reader)
+ 
+     def test_streamreaderprotocol_constructor_use_running_loop(self):
+         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
+@@ -786,11 +792,13 @@
+     def test_streamreaderprotocol_constructor_use_global_loop(self):
+         # asyncio issue #184: Ensure that StreamReaderProtocol constructor
+         # retrieves the current loop if the loop parameter is not set
++        # Deprecated in 3.10
+-        # Deprecated in 3.10, undeprecated in 3.11.1
+         self.addCleanup(asyncio.set_event_loop, None)
+         asyncio.set_event_loop(self.loop)
+         reader = mock.Mock()
++        with self.assertWarns(DeprecationWarning) as cm:
++            protocol = asyncio.StreamReaderProtocol(reader)
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        protocol = asyncio.StreamReaderProtocol(reader)
+         self.assertIs(protocol._loop, self.loop)
+ 
+     def test_multiple_drain(self):
+reverted:
+--- b/Lib/test/test_asyncio/test_tasks.py
++++ a/Lib/test/test_asyncio/test_tasks.py
+@@ -210,8 +210,10 @@
+ 
+         a = notmuch()
+         self.addCleanup(a.close)
++        with self.assertWarns(DeprecationWarning) as cm:
++            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
++                asyncio.ensure_future(a)
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
+-            asyncio.ensure_future(a)
+ 
+         async def test():
+             return asyncio.ensure_future(notmuch())
+@@ -221,10 +223,12 @@
+         self.assertTrue(t.done())
+         self.assertEqual(t.result(), 'ok')
+ 
++        # Deprecated in 3.10
+-        # Deprecated in 3.10.0, undeprecated in 3.10.9
+         asyncio.set_event_loop(self.loop)
+         self.addCleanup(asyncio.set_event_loop, None)
++        with self.assertWarns(DeprecationWarning) as cm:
++            t = asyncio.ensure_future(notmuch())
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        t = asyncio.ensure_future(notmuch())
+         self.assertIs(t._loop, self.loop)
+         self.loop.run_until_complete(t)
+         self.assertTrue(t.done())
+@@ -243,8 +247,10 @@
+ 
+         a = notmuch()
+         self.addCleanup(a.close)
++        with self.assertWarns(DeprecationWarning) as cm:
++            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
++                asyncio.ensure_future(a)
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
+-            asyncio.ensure_future(a)
+ 
+         async def test():
+             return asyncio.ensure_future(notmuch())
+@@ -254,10 +260,12 @@
+         self.assertTrue(t.done())
+         self.assertEqual(t.result(), 'ok')
+ 
++        # Deprecated in 3.10
+-        # Deprecated in 3.10.0, undeprecated in 3.10.9
+         asyncio.set_event_loop(self.loop)
+         self.addCleanup(asyncio.set_event_loop, None)
++        with self.assertWarns(DeprecationWarning) as cm:
++            t = asyncio.ensure_future(notmuch())
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        t = asyncio.ensure_future(notmuch())
+         self.assertIs(t._loop, self.loop)
+         self.loop.run_until_complete(t)
+         self.assertTrue(t.done())
+@@ -1480,8 +1488,10 @@
+         self.addCleanup(a.close)
+ 
+         futs = asyncio.as_completed([a])
++        with self.assertWarns(DeprecationWarning) as cm:
++            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
++                list(futs)
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
+-            list(futs)
+ 
+     def test_as_completed_coroutine_use_running_loop(self):
+         loop = self.new_test_loop()
+@@ -1497,14 +1507,17 @@
+         loop.run_until_complete(test())
+ 
+     def test_as_completed_coroutine_use_global_loop(self):
++        # Deprecated in 3.10
+-        # Deprecated in 3.10.0, undeprecated in 3.10.9
+         async def coro():
+             return 42
+ 
+         loop = self.new_test_loop()
+         asyncio.set_event_loop(loop)
+         self.addCleanup(asyncio.set_event_loop, None)
++        futs = asyncio.as_completed([coro()])
++        with self.assertWarns(DeprecationWarning) as cm:
++            futs = list(futs)
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        futs = list(asyncio.as_completed([coro()]))
+         self.assertEqual(len(futs), 1)
+         self.assertEqual(loop.run_until_complete(futs[0]), 42)
+ 
+@@ -1974,8 +1987,10 @@
+ 
+         inner = coro()
+         self.addCleanup(inner.close)
++        with self.assertWarns(DeprecationWarning) as cm:
++            with self.assertRaisesRegex(RuntimeError, 'There is no current event loop'):
++                asyncio.shield(inner)
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
+-            asyncio.shield(inner)
+ 
+     def test_shield_coroutine_use_running_loop(self):
+         async def coro():
+@@ -1989,13 +2004,15 @@
+         self.assertEqual(res, 42)
+ 
+     def test_shield_coroutine_use_global_loop(self):
++        # Deprecated in 3.10
+-        # Deprecated in 3.10.0, undeprecated in 3.10.9
+         async def coro():
+             return 42
+ 
+         asyncio.set_event_loop(self.loop)
+         self.addCleanup(asyncio.set_event_loop, None)
++        with self.assertWarns(DeprecationWarning) as cm:
++            outer = asyncio.shield(coro())
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        outer = asyncio.shield(coro())
+         self.assertEqual(outer._loop, self.loop)
+         res = self.loop.run_until_complete(outer)
+         self.assertEqual(res, 42)
+@@ -2933,7 +2950,7 @@
+         self.assertIsNone(asyncio.current_task(loop=self.loop))
+ 
+     def test_current_task_no_running_loop_implicit(self):
++        with self.assertRaises(RuntimeError):
+-        with self.assertRaisesRegex(RuntimeError, 'no running event loop'):
+             asyncio.current_task()
+ 
+     def test_current_task_with_implicit_loop(self):
+@@ -3097,8 +3114,10 @@
+         return asyncio.gather(*args, **kwargs)
+ 
+     def test_constructor_empty_sequence_without_loop(self):
++        with self.assertWarns(DeprecationWarning) as cm:
++            with self.assertRaises(RuntimeError):
++                asyncio.gather()
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
+-            asyncio.gather()
+ 
+     def test_constructor_empty_sequence_use_running_loop(self):
+         async def gather():
+@@ -3111,10 +3130,12 @@
+         self.assertEqual(fut.result(), [])
+ 
+     def test_constructor_empty_sequence_use_global_loop(self):
++        # Deprecated in 3.10
+-        # Deprecated in 3.10.0, undeprecated in 3.10.9
+         asyncio.set_event_loop(self.one_loop)
+         self.addCleanup(asyncio.set_event_loop, None)
++        with self.assertWarns(DeprecationWarning) as cm:
++            fut = asyncio.gather()
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        fut = asyncio.gather()
+         self.assertIsInstance(fut, asyncio.Future)
+         self.assertIs(fut._loop, self.one_loop)
+         self._run_loop(self.one_loop)
+@@ -3202,8 +3223,10 @@
+         self.addCleanup(gen1.close)
+         gen2 = coro()
+         self.addCleanup(gen2.close)
++        with self.assertWarns(DeprecationWarning) as cm:
++            with self.assertRaises(RuntimeError):
++                asyncio.gather(gen1, gen2)
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        with self.assertRaisesRegex(RuntimeError, 'no current event loop'):
+-            asyncio.gather(gen1, gen2)
+ 
+     def test_constructor_use_running_loop(self):
+         async def coro():
+@@ -3217,14 +3240,16 @@
+         self.one_loop.run_until_complete(fut)
+ 
+     def test_constructor_use_global_loop(self):
++        # Deprecated in 3.10
+-        # Deprecated in 3.10.0, undeprecated in 3.10.9
+         async def coro():
+             return 'abc'
+         asyncio.set_event_loop(self.other_loop)
+         self.addCleanup(asyncio.set_event_loop, None)
+         gen1 = coro()
+         gen2 = coro()
++        with self.assertWarns(DeprecationWarning) as cm:
++            fut = asyncio.gather(gen1, gen2)
++        self.assertEqual(cm.warnings[0].filename, __file__)
+-        fut = asyncio.gather(gen1, gen2)
+         self.assertIs(fut._loop, self.other_loop)
+         self.other_loop.run_until_complete(fut)
+ 
+reverted:
+--- b/Lib/test/test_asyncio/test_unix_events.py
++++ a/Lib/test/test_asyncio/test_unix_events.py
+@@ -1740,8 +1740,7 @@
+ 
+     def test_child_watcher_replace_mainloop_existing(self):
+         policy = self.create_policy()
++        loop = policy.get_event_loop()
+-        loop = policy.new_event_loop()
+-        policy.set_event_loop(loop)
+ 
+         # Explicitly setup SafeChildWatcher,
+         # default ThreadedChildWatcher has no _loop property
+reverted:
+--- b/Lib/test/test_coroutines.py
++++ a/Lib/test/test_coroutines.py
+@@ -2319,8 +2319,7 @@
+     def test_unawaited_warning_during_shutdown(self):
+         code = ("import asyncio\n"
+                 "async def f(): pass\n"
++                "asyncio.gather(f())\n")
+-                "async def t(): asyncio.gather(f())\n"
+-                "asyncio.run(t())\n")
+         assert_python_ok("-c", code)
+ 
+         code = ("import sys\n"
+reverted:
+--- b/Modules/_asynciomodule.c
++++ a/Modules/_asynciomodule.c
+@@ -332,6 +332,13 @@
+         return loop;
+     }
+ 
++    if (PyErr_WarnEx(PyExc_DeprecationWarning,
++                     "There is no current event loop",
++                     stacklevel))
++    {
++        return NULL;
++    }
++
+     policy = PyObject_CallNoArgs(asyncio_get_event_loop_policy);
+     if (policy == NULL) {
+         return NULL;
+@@ -3085,11 +3092,6 @@
+     return get_event_loop(1);
+ }
+ 
+-// This internal method is going away in Python 3.12, left here only for
+-// backwards compatibility with 3.10.0 - 3.10.8 and 3.11.0.
+-// Similarly, this method's Python equivalent in asyncio.events is going
+-// away as well.
+-// See GH-99949 for more details.
+ /*[clinic input]
+ _asyncio._get_event_loop
+     stacklevel: int = 3
diff --git a/pkgs/development/interpreters/python/cpython/3.6/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/3.12/no-ldconfig.patch
similarity index 50%
rename from pkgs/development/interpreters/python/cpython/3.6/no-ldconfig.patch
rename to pkgs/development/interpreters/python/cpython/3.12/no-ldconfig.patch
index 0f829860a5b76..ca6a76d0ffd98 100644
--- a/pkgs/development/interpreters/python/cpython/3.6/no-ldconfig.patch
+++ b/pkgs/development/interpreters/python/cpython/3.12/no-ldconfig.patch
@@ -1,19 +1,18 @@
-From 105621b99cc30615c79b5aa3d12d6732e14b0d59 Mon Sep 17 00:00:00 2001
-From: Frederik Rietdijk <fridh@fridh.nl>
-Date: Mon, 28 Aug 2017 09:24:06 +0200
-Subject: [PATCH] Don't use ldconfig and speed up uuid load
+From 5330b6af9f832af59aa5c61d9ef6971053a8e709 Mon Sep 17 00:00:00 2001
+From: Jonathan Ringer <jonringer117@gmail.com>
+Date: Mon, 9 Nov 2020 10:24:35 -0800
+Subject: [PATCH] CPython: Don't use ldconfig
 
 ---
- Lib/ctypes/util.py | 70 ++----------------------------------------------------
- Lib/uuid.py        | 48 -------------------------------------
- 2 files changed, 2 insertions(+), 116 deletions(-)
+ Lib/ctypes/util.py | 77 ++--------------------------------------------
+ 1 file changed, 2 insertions(+), 75 deletions(-)
 
 diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
-index 339ae8aa8a..2944985c30 100644
+index 0c2510e161..7fb98af308 100644
 --- a/Lib/ctypes/util.py
 +++ b/Lib/ctypes/util.py
-@@ -85,46 +85,7 @@ elif os.name == "posix":
-     import re, tempfile
+@@ -100,53 +100,7 @@ def _is_elf(filename):
+             return thefile.read(4) == elf_header
  
      def _findLib_gcc(name):
 -        # Run GCC's linker with the -t (aka --trace) option and examine the
@@ -52,15 +51,22 @@ index 339ae8aa8a..2944985c30 100644
 -                # Raised if the file was already removed, which is the normal
 -                # behaviour of GCC if linking fails
 -                pass
--        res = re.search(expr, trace)
+-        res = re.findall(expr, trace)
 -        if not res:
 -            return None
--        return os.fsdecode(res.group(0))
+-
+-        for file in res:
+-            # Check if the given file is an elf file: gcc can report
+-            # some files that are linker scripts and not actual
+-            # shared objects. See bpo-41976 for more details
+-            if not _is_elf(file):
+-                continue
+-            return os.fsdecode(file)
 +        return None
  
  
      if sys.platform == "sunos5":
-@@ -246,34 +207,7 @@ elif os.name == "posix":
+@@ -268,34 +222,7 @@ def find_library(name, is64 = False):
      else:
  
          def _findSoname_ldconfig(name):
@@ -96,68 +102,6 @@ index 339ae8aa8a..2944985c30 100644
  
          def _findLib_ld(name):
              # See issue #9998 for why this is needed
-diff --git a/Lib/uuid.py b/Lib/uuid.py
-index 200c800b34..31160ace95 100644
---- a/Lib/uuid.py
-+++ b/Lib/uuid.py
-@@ -455,57 +455,9 @@ def _netbios_getnode():
-             continue
-         return int.from_bytes(bytes, 'big')
- 
--# Thanks to Thomas Heller for ctypes and for his help with its use here.
- 
--# If ctypes is available, use it to find system routines for UUID generation.
--# XXX This makes the module non-thread-safe!
- _uuid_generate_time = _UuidCreate = None
--try:
--    import ctypes, ctypes.util
--    import sys
- 
--    # The uuid_generate_* routines are provided by libuuid on at least
--    # Linux and FreeBSD, and provided by libc on Mac OS X.
--    _libnames = ['uuid']
--    if not sys.platform.startswith('win'):
--        _libnames.append('c')
--    for libname in _libnames:
--        try:
--            lib = ctypes.CDLL(ctypes.util.find_library(libname))
--        except Exception:
--            continue
--        if hasattr(lib, 'uuid_generate_time'):
--            _uuid_generate_time = lib.uuid_generate_time
--            break
--    del _libnames
--
--    # The uuid_generate_* functions are broken on MacOS X 10.5, as noted
--    # in issue #8621 the function generates the same sequence of values
--    # in the parent process and all children created using fork (unless
--    # those children use exec as well).
--    #
--    # Assume that the uuid_generate functions are broken from 10.5 onward,
--    # the test can be adjusted when a later version is fixed.
--    if sys.platform == 'darwin':
--        if int(os.uname().release.split('.')[0]) >= 9:
--            _uuid_generate_time = None
--
--    # On Windows prior to 2000, UuidCreate gives a UUID containing the
--    # hardware address.  On Windows 2000 and later, UuidCreate makes a
--    # random UUID and UuidCreateSequential gives a UUID containing the
--    # hardware address.  These routines are provided by the RPC runtime.
--    # NOTE:  at least on Tim's WinXP Pro SP2 desktop box, while the last
--    # 6 bytes returned by UuidCreateSequential are fixed, they don't appear
--    # to bear any relationship to the MAC address of any network device
--    # on the box.
--    try:
--        lib = ctypes.windll.rpcrt4
--    except:
--        lib = None
--    _UuidCreate = getattr(lib, 'UuidCreateSequential',
--                          getattr(lib, 'UuidCreate', None))
--except:
--    pass
- 
- def _unixdll_getnode():
-     """Get the hardware address on Unix using ctypes."""
 -- 
-2.14.1
+2.33.1
 
diff --git a/pkgs/development/interpreters/python/cpython/3.5/force_bytecode_determinism.patch b/pkgs/development/interpreters/python/cpython/3.5/force_bytecode_determinism.patch
deleted file mode 100644
index c263cdbff4db8..0000000000000
--- a/pkgs/development/interpreters/python/cpython/3.5/force_bytecode_determinism.patch
+++ /dev/null
@@ -1,17 +0,0 @@
---- a/Lib/py_compile.py
-+++ b/Lib/py_compile.py
-@@ -139,3 +139,4 @@
-     source_stats = loader.path_stats(file)
-+    source_mtime = 1 if 'DETERMINISTIC_BUILD' in os.environ else source_stats['mtime']
-     bytecode = importlib._bootstrap_external._code_to_bytecode(
--            code, source_stats['mtime'], source_stats['size'])
-+            code, source_mtime, source_stats['size'])
---- a/Lib/importlib/_bootstrap_external.py
-+++ b/Lib/importlib/_bootstrap_external.py
-@@ -485,5 +485,5 @@
-     if source_stats is not None:
-         try:
--            source_mtime = int(source_stats['mtime'])
-+            source_mtime = 1
-         except KeyError:
-             pass
diff --git a/pkgs/development/interpreters/python/cpython/3.5/ld_library_path.patch b/pkgs/development/interpreters/python/cpython/3.5/ld_library_path.patch
deleted file mode 100644
index 013c2d266eff9..0000000000000
--- a/pkgs/development/interpreters/python/cpython/3.5/ld_library_path.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 918201682127ed8a270a4bd1a448b490019e4ada Mon Sep 17 00:00:00 2001
-From: Frederik Rietdijk <fridh@fridh.nl>
-Date: Thu, 14 Sep 2017 10:00:31 +0200
-Subject: [PATCH] ctypes.util: support LD_LIBRARY_PATH
-
-Backports support for LD_LIBRARY_PATH from 3.6
----
- Lib/ctypes/util.py | 26 +++++++++++++++++++++++++-
- 1 file changed, 25 insertions(+), 1 deletion(-)
-
-diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
-index e9957d7951..9926f6c881 100644
---- a/Lib/ctypes/util.py
-+++ b/Lib/ctypes/util.py
-@@ -219,8 +219,32 @@ elif os.name == "posix":
-         def _findSoname_ldconfig(name):
-             return None
- 
-+        def _findLib_ld(name):
-+            # See issue #9998 for why this is needed
-+            expr = r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name)
-+            cmd = ['ld', '-t']
-+            libpath = os.environ.get('LD_LIBRARY_PATH')
-+            if libpath:
-+                for d in libpath.split(':'):
-+                    cmd.extend(['-L', d])
-+            cmd.extend(['-o', os.devnull, '-l%s' % name])
-+            result = None
-+            try:
-+                p = subprocess.Popen(cmd, stdout=subprocess.PIPE,
-+                                     stderr=subprocess.PIPE,
-+                                     universal_newlines=True)
-+                out, _ = p.communicate()
-+                res = re.search(expr, os.fsdecode(out))
-+                if res:
-+                    result = res.group(0)
-+            except Exception as e:
-+                pass  # result will be None
-+            return result
-+
-         def find_library(name):
--            return _findSoname_ldconfig(name) or _get_soname(_findLib_gcc(name))
-+            # See issue #9998
-+            return _findSoname_ldconfig(name) or \
-+                   _get_soname(_findLib_gcc(name) or _findLib_ld(name))
- 
- ################################################################
- # test code
--- 
-2.14.1
-
diff --git a/pkgs/development/interpreters/python/cpython/3.5/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/3.5/no-ldconfig.patch
deleted file mode 100644
index 9718b1d8dceb4..0000000000000
--- a/pkgs/development/interpreters/python/cpython/3.5/no-ldconfig.patch
+++ /dev/null
@@ -1,164 +0,0 @@
-From 590c46bb04f79ab611b2f8fd682dd7e43a01f268 Mon Sep 17 00:00:00 2001
-From: Frederik Rietdijk <fridh@fridh.nl>
-Date: Mon, 28 Aug 2017 09:24:06 +0200
-Subject: [PATCH] Don't use ldconfig and speed up uuid load
-
----
- Lib/ctypes/util.py | 70 ++----------------------------------------------------
- Lib/uuid.py        | 49 --------------------------------------
- 2 files changed, 2 insertions(+), 117 deletions(-)
-
-diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
-index 7684eab81d..e9957d7951 100644
---- a/Lib/ctypes/util.py
-+++ b/Lib/ctypes/util.py
-@@ -95,46 +95,7 @@ elif os.name == "posix":
-     import re, tempfile
- 
-     def _findLib_gcc(name):
--        # Run GCC's linker with the -t (aka --trace) option and examine the
--        # library name it prints out. The GCC command will fail because we
--        # haven't supplied a proper program with main(), but that does not
--        # matter.
--        expr = os.fsencode(r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name))
--
--        c_compiler = shutil.which('gcc')
--        if not c_compiler:
--            c_compiler = shutil.which('cc')
--        if not c_compiler:
--            # No C compiler available, give up
--            return None
--
--        temp = tempfile.NamedTemporaryFile()
--        try:
--            args = [c_compiler, '-Wl,-t', '-o', temp.name, '-l' + name]
--
--            env = dict(os.environ)
--            env['LC_ALL'] = 'C'
--            env['LANG'] = 'C'
--            try:
--                proc = subprocess.Popen(args,
--                                        stdout=subprocess.PIPE,
--                                        stderr=subprocess.STDOUT,
--                                        env=env)
--            except OSError:  # E.g. bad executable
--                return None
--            with proc:
--                trace = proc.stdout.read()
--        finally:
--            try:
--                temp.close()
--            except FileNotFoundError:
--                # Raised if the file was already removed, which is the normal
--                # behaviour of GCC if linking fails
--                pass
--        res = re.search(expr, trace)
--        if not res:
--            return None
--        return os.fsdecode(res.group(0))
-+        return None
- 
- 
-     if sys.platform == "sunos5":
-@@ -256,34 +217,7 @@ elif os.name == "posix":
-     else:
- 
-         def _findSoname_ldconfig(name):
--            import struct
--            if struct.calcsize('l') == 4:
--                machine = os.uname().machine + '-32'
--            else:
--                machine = os.uname().machine + '-64'
--            mach_map = {
--                'x86_64-64': 'libc6,x86-64',
--                'ppc64-64': 'libc6,64bit',
--                'sparc64-64': 'libc6,64bit',
--                's390x-64': 'libc6,64bit',
--                'ia64-64': 'libc6,IA-64',
--                }
--            abi_type = mach_map.get(machine, 'libc6')
--
--            # XXX assuming GLIBC's ldconfig (with option -p)
--            regex = os.fsencode(
--                '\s+(lib%s\.[^\s]+)\s+\(%s' % (re.escape(name), abi_type))
--            try:
--                with subprocess.Popen(['/sbin/ldconfig', '-p'],
--                                      stdin=subprocess.DEVNULL,
--                                      stderr=subprocess.DEVNULL,
--                                      stdout=subprocess.PIPE,
--                                      env={'LC_ALL': 'C', 'LANG': 'C'}) as p:
--                    res = re.search(regex, p.stdout.read())
--                    if res:
--                        return os.fsdecode(res.group(1))
--            except OSError:
--                pass
-+            return None
- 
-         def find_library(name):
-             return _findSoname_ldconfig(name) or _get_soname(_findLib_gcc(name))
-diff --git a/Lib/uuid.py b/Lib/uuid.py
-index e96e7e034c..31160ace95 100644
---- a/Lib/uuid.py
-+++ b/Lib/uuid.py
-@@ -455,58 +455,9 @@ def _netbios_getnode():
-             continue
-         return int.from_bytes(bytes, 'big')
- 
--# Thanks to Thomas Heller for ctypes and for his help with its use here.
- 
--# If ctypes is available, use it to find system routines for UUID generation.
--# XXX This makes the module non-thread-safe!
- _uuid_generate_time = _UuidCreate = None
--try:
--    import ctypes, ctypes.util
--    import sys
- 
--    # The uuid_generate_* routines are provided by libuuid on at least
--    # Linux and FreeBSD, and provided by libc on Mac OS X.
--    _libnames = ['uuid']
--    if not sys.platform.startswith('win'):
--        _libnames.append('c')
--    for libname in _libnames:
--        try:
--            lib = ctypes.CDLL(ctypes.util.find_library(libname))
--        except Exception:
--            continue
--        if hasattr(lib, 'uuid_generate_time'):
--            _uuid_generate_time = lib.uuid_generate_time
--            break
--    del _libnames
--
--    # The uuid_generate_* functions are broken on MacOS X 10.5, as noted
--    # in issue #8621 the function generates the same sequence of values
--    # in the parent process and all children created using fork (unless
--    # those children use exec as well).
--    #
--    # Assume that the uuid_generate functions are broken from 10.5 onward,
--    # the test can be adjusted when a later version is fixed.
--    if sys.platform == 'darwin':
--        import os
--        if int(os.uname().release.split('.')[0]) >= 9:
--            _uuid_generate_time = None
--
--    # On Windows prior to 2000, UuidCreate gives a UUID containing the
--    # hardware address.  On Windows 2000 and later, UuidCreate makes a
--    # random UUID and UuidCreateSequential gives a UUID containing the
--    # hardware address.  These routines are provided by the RPC runtime.
--    # NOTE:  at least on Tim's WinXP Pro SP2 desktop box, while the last
--    # 6 bytes returned by UuidCreateSequential are fixed, they don't appear
--    # to bear any relationship to the MAC address of any network device
--    # on the box.
--    try:
--        lib = ctypes.windll.rpcrt4
--    except:
--        lib = None
--    _UuidCreate = getattr(lib, 'UuidCreateSequential',
--                          getattr(lib, 'UuidCreate', None))
--except:
--    pass
- 
- def _unixdll_getnode():
-     """Get the hardware address on Unix using ctypes."""
--- 
-2.14.1
-
diff --git a/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch b/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch
deleted file mode 100644
index 39d5587379cab..0000000000000
--- a/pkgs/development/interpreters/python/cpython/3.5/profile-task.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-Backport from CPython 3.8 of a good list of tests to run for PGO.
-
-Upstream commit:
-  https://github.com/python/cpython/commit/4e16a4a31
-
-Upstream discussion:
-  https://bugs.python.org/issue36044
-
-diff --git a/Makefile.pre.in b/Makefile.pre.in
-index 00fdd21ce..713dc1e53 100644
---- a/Makefile.pre.in
-+++ b/Makefile.pre.in
-@@ -259,7 +259,7 @@ TCLTK_LIBS=
- # The task to run while instrumented when building the profile-opt target.
- # We exclude unittests with -x that take a rediculious amount of time to
- # run in the instrumented training build or do not provide much value.
--PROFILE_TASK=-m test.regrtest --pgo -x test_asyncore test_gdb test_multiprocessing_fork test_multiprocessing_forkserver test_multiprocessing_main_handling test_multiprocessing_spawn test_subprocess
-+PROFILE_TASK=-m test.regrtest --pgo test_array test_base64 test_binascii test_binop test_bisect test_bytes test_bz2 test_cmath test_codecs test_collections test_complex test_dataclasses test_datetime test_decimal test_difflib test_embed test_float test_fstring test_functools test_generators test_hashlib test_heapq test_int test_itertools test_json test_long test_lzma test_math test_memoryview test_operator test_ordered_dict test_pickle test_pprint test_re test_set test_sqlite test_statistics test_struct test_tabnanny test_time test_unicode test_xml_etree test_xml_etree_c
- 
- # report files for gcov / lcov coverage report
- COVERAGE_INFO= $(abs_builddir)/coverage.info
diff --git a/pkgs/development/interpreters/python/cpython/3.5/python-3.x-distutils-C++.patch b/pkgs/development/interpreters/python/cpython/3.5/python-3.x-distutils-C++.patch
deleted file mode 100644
index 01356020b394c..0000000000000
--- a/pkgs/development/interpreters/python/cpython/3.5/python-3.x-distutils-C++.patch
+++ /dev/null
@@ -1,237 +0,0 @@
-Source: https://bugs.python.org/file47046/python-3.x-distutils-C++.patch
---- a/Lib/distutils/cygwinccompiler.py
-+++ b/Lib/distutils/cygwinccompiler.py
-@@ -125,8 +125,10 @@
-         # dllwrap 2.10.90 is buggy
-         if self.ld_version >= "2.10.90":
-             self.linker_dll = "gcc"
-+            self.linker_dll_cxx = "g++"
-         else:
-             self.linker_dll = "dllwrap"
-+            self.linker_dll_cxx = "dllwrap"
-
-         # ld_version >= "2.13" support -shared so use it instead of
-         # -mdll -static
-@@ -140,9 +142,13 @@
-         self.set_executables(compiler='gcc -mcygwin -O -Wall',
-                              compiler_so='gcc -mcygwin -mdll -O -Wall',
-                              compiler_cxx='g++ -mcygwin -O -Wall',
-+                             compiler_so_cxx='g++ -mcygwin -mdll -O -Wall',
-                              linker_exe='gcc -mcygwin',
-                              linker_so=('%s -mcygwin %s' %
--                                        (self.linker_dll, shared_option)))
-+                                        (self.linker_dll, shared_option)),
-+                             linker_exe_cxx='g++ -mcygwin',
-+                             linker_so_cxx=('%s -mcygwin %s' %
-+                                            (self.linker_dll_cxx, shared_option)))
-
-         # cygwin and mingw32 need different sets of libraries
-         if self.gcc_version == "2.91.57":
-@@ -166,8 +172,12 @@
-                 raise CompileError(msg)
-         else: # for other files use the C-compiler
-             try:
--                self.spawn(self.compiler_so + cc_args + [src, '-o', obj] +
--                           extra_postargs)
-+                if self.detect_language(src) == 'c++':
-+                    self.spawn(self.compiler_so_cxx + cc_args + [src, '-o', obj] +
-+                               extra_postargs)
-+                else:
-+                    self.spawn(self.compiler_so + cc_args + [src, '-o', obj] +
-+                               extra_postargs)
-             except DistutilsExecError as msg:
-                 raise CompileError(msg)
-
-@@ -302,9 +312,14 @@
-         self.set_executables(compiler='gcc -O -Wall',
-                              compiler_so='gcc -mdll -O -Wall',
-                              compiler_cxx='g++ -O -Wall',
-+                             compiler_so_cxx='g++ -mdll -O -Wall',
-                              linker_exe='gcc',
-                              linker_so='%s %s %s'
-                                         % (self.linker_dll, shared_option,
-+                                           entry_point),
-+                             linker_exe_cxx='g++',
-+                             linker_so_cxx='%s %s %s'
-+                                        % (self.linker_dll_cxx, shared_option,
-                                            entry_point))
-         # Maybe we should also append -mthreads, but then the finished
-         # dlls need another dll (mingwm10.dll see Mingw32 docs)
---- a/Lib/distutils/sysconfig.py
-+++ b/Lib/distutils/sysconfig.py
-@@ -184,9 +184,11 @@
-                 _osx_support.customize_compiler(_config_vars)
-                 _config_vars['CUSTOMIZED_OSX_COMPILER'] = 'True'
-
--        (cc, cxx, opt, cflags, ccshared, ldshared, shlib_suffix, ar, ar_flags) = \
--            get_config_vars('CC', 'CXX', 'OPT', 'CFLAGS',
--                            'CCSHARED', 'LDSHARED', 'SHLIB_SUFFIX', 'AR', 'ARFLAGS')
-+        (cc, cxx, cflags, ccshared, ldshared, ldcxxshared, shlib_suffix, ar, ar_flags) = \
-+            get_config_vars('CC', 'CXX', 'CFLAGS', 'CCSHARED', 'LDSHARED', 'LDCXXSHARED',
-+                            'SHLIB_SUFFIX', 'AR', 'ARFLAGS')
-+
-+        cxxflags = cflags
-
-         if 'CC' in os.environ:
-             newcc = os.environ['CC']
-@@ -201,19 +204,27 @@
-             cxx = os.environ['CXX']
-         if 'LDSHARED' in os.environ:
-             ldshared = os.environ['LDSHARED']
-+        if 'LDCXXSHARED' in os.environ:
-+            ldcxxshared = os.environ['LDCXXSHARED']
-         if 'CPP' in os.environ:
-             cpp = os.environ['CPP']
-         else:
-             cpp = cc + " -E"           # not always
-         if 'LDFLAGS' in os.environ:
-             ldshared = ldshared + ' ' + os.environ['LDFLAGS']
-+            ldcxxshared = ldcxxshared + ' ' + os.environ['LDFLAGS']
-         if 'CFLAGS' in os.environ:
--            cflags = opt + ' ' + os.environ['CFLAGS']
-+            cflags = os.environ['CFLAGS']
-             ldshared = ldshared + ' ' + os.environ['CFLAGS']
-+        if 'CXXFLAGS' in os.environ:
-+            cxxflags = os.environ['CXXFLAGS']
-+            ldcxxshared = ldcxxshared + ' ' + os.environ['CXXFLAGS']
-         if 'CPPFLAGS' in os.environ:
-             cpp = cpp + ' ' + os.environ['CPPFLAGS']
-             cflags = cflags + ' ' + os.environ['CPPFLAGS']
-+            cxxflags = cxxflags + ' ' + os.environ['CPPFLAGS']
-             ldshared = ldshared + ' ' + os.environ['CPPFLAGS']
-+            ldcxxshared = ldcxxshared + ' ' + os.environ['CPPFLAGS']
-         if 'AR' in os.environ:
-             ar = os.environ['AR']
-         if 'ARFLAGS' in os.environ:
-@@ -222,13 +233,17 @@
-             archiver = ar + ' ' + ar_flags
-
-         cc_cmd = cc + ' ' + cflags
-+        cxx_cmd = cxx + ' ' + cxxflags
-         compiler.set_executables(
-             preprocessor=cpp,
-             compiler=cc_cmd,
-             compiler_so=cc_cmd + ' ' + ccshared,
--            compiler_cxx=cxx,
-+            compiler_cxx=cxx_cmd,
-+            compiler_so_cxx=cxx_cmd + ' ' + ccshared,
-             linker_so=ldshared,
-             linker_exe=cc,
-+            linker_so_cxx=ldcxxshared,
-+            linker_exe_cxx=cxx,
-             archiver=archiver)
-
-         compiler.shared_lib_extension = shlib_suffix
---- a/Lib/distutils/unixccompiler.py
-+++ b/Lib/distutils/unixccompiler.py
-@@ -52,14 +52,17 @@
-     # are pretty generic; they will probably have to be set by an outsider
-     # (eg. using information discovered by the sysconfig about building
-     # Python extensions).
--    executables = {'preprocessor' : None,
--                   'compiler'     : ["cc"],
--                   'compiler_so'  : ["cc"],
--                   'compiler_cxx' : ["cc"],
--                   'linker_so'    : ["cc", "-shared"],
--                   'linker_exe'   : ["cc"],
--                   'archiver'     : ["ar", "-cr"],
--                   'ranlib'       : None,
-+    executables = {'preprocessor'    : None,
-+                   'compiler'        : ["cc"],
-+                   'compiler_so'     : ["cc"],
-+                   'compiler_cxx'    : ["c++"],
-+                   'compiler_so_cxx' : ["c++"],
-+                   'linker_so'       : ["cc", "-shared"],
-+                   'linker_exe'      : ["cc"],
-+                   'linker_so_cxx'   : ["c++", "-shared"],
-+                   'linker_exe_cxx'  : ["c++"],
-+                   'archiver'        : ["ar", "-cr"],
-+                   'ranlib'          : None,
-                   }
-
-     if sys.platform[:6] == "darwin":
-@@ -108,12 +111,19 @@
-
-     def _compile(self, obj, src, ext, cc_args, extra_postargs, pp_opts):
-         compiler_so = self.compiler_so
-+        compiler_so_cxx = self.compiler_so_cxx
-         if sys.platform == 'darwin':
-             compiler_so = _osx_support.compiler_fixup(compiler_so,
-                                                     cc_args + extra_postargs)
-+            compiler_so_cxx = _osx_support.compiler_fixup(compiler_so_cxx,
-+                                                    cc_args + extra_postargs)
-         try:
--            self.spawn(compiler_so + cc_args + [src, '-o', obj] +
--                       extra_postargs)
-+            if self.detect_language(src) == 'c++':
-+                self.spawn(compiler_so_cxx + cc_args + [src, '-o', obj] +
-+                           extra_postargs)
-+            else:
-+                self.spawn(compiler_so + cc_args + [src, '-o', obj] +
-+                           extra_postargs)
-         except DistutilsExecError as msg:
-             raise CompileError(msg)
-
-@@ -171,22 +181,16 @@
-                 ld_args.extend(extra_postargs)
-             self.mkpath(os.path.dirname(output_filename))
-             try:
--                if target_desc == CCompiler.EXECUTABLE:
--                    linker = self.linker_exe[:]
-+                if target_lang == "c++":
-+                    if target_desc == CCompiler.EXECUTABLE:
-+                        linker = self.linker_exe_cxx[:]
-+                    else:
-+                        linker = self.linker_so_cxx[:]
-                 else:
--                    linker = self.linker_so[:]
--                if target_lang == "c++" and self.compiler_cxx:
--                    # skip over environment variable settings if /usr/bin/env
--                    # is used to set up the linker's environment.
--                    # This is needed on OSX. Note: this assumes that the
--                    # normal and C++ compiler have the same environment
--                    # settings.
--                    i = 0
--                    if os.path.basename(linker[0]) == "env":
--                        i = 1
--                        while '=' in linker[i]:
--                            i += 1
--                    linker[i] = self.compiler_cxx[i]
-+                    if target_desc == CCompiler.EXECUTABLE:
-+                        linker = self.linker_exe[:]
-+                    else:
-+                        linker = self.linker_so[:]
-
-                 if sys.platform == 'darwin':
-                     linker = _osx_support.compiler_fixup(linker, ld_args)
---- a/Lib/_osx_support.py
-+++ b/Lib/_osx_support.py
-@@ -14,13 +14,13 @@
- # configuration variables that may contain universal build flags,
- # like "-arch" or "-isdkroot", that may need customization for
- # the user environment
--_UNIVERSAL_CONFIG_VARS = ('CFLAGS', 'LDFLAGS', 'CPPFLAGS', 'BASECFLAGS',
--                            'BLDSHARED', 'LDSHARED', 'CC', 'CXX',
--                            'PY_CFLAGS', 'PY_LDFLAGS', 'PY_CPPFLAGS',
--                            'PY_CORE_CFLAGS')
-+_UNIVERSAL_CONFIG_VARS = ('CFLAGS', 'CXXFLAGS', 'LDFLAGS', 'CPPFLAGS',
-+                          'BASECFLAGS', 'BLDSHARED', 'LDSHARED', 'LDCXXSHARED',
-+                          'CC', 'CXX', 'PY_CFLAGS', 'PY_LDFLAGS',
-+                          'PY_CPPFLAGS', 'PY_CORE_CFLAGS')
-
- # configuration variables that may contain compiler calls
--_COMPILER_CONFIG_VARS = ('BLDSHARED', 'LDSHARED', 'CC', 'CXX')
-+_COMPILER_CONFIG_VARS = ('BLDSHARED', 'LDSHARED', 'LDCXXSHARED', 'CC', 'CXX')
-
- # prefix added to original configuration variable names
- _INITPRE = '_OSX_SUPPORT_INITIAL_'
---- a/Makefile.pre.in
-+++ b/Makefile.pre.in
-@@ -538,7 +538,7 @@
- 	    *\ -s*|s*) quiet="-q";; \
- 	    *) quiet="";; \
- 	esac; \
--	$(RUNSHARED) CC='$(CC)' LDSHARED='$(BLDSHARED)' OPT='$(OPT)' \
-+	$(RUNSHARED) CC='$(CC)' LDSHARED='$(BLDSHARED)' CFLAGS='$(PY_CFLAGS)' \
- 		_TCLTK_INCLUDES='$(TCLTK_INCLUDES)' _TCLTK_LIBS='$(TCLTK_LIBS)' \
- 		$(PYTHON_FOR_BUILD) $(srcdir)/setup.py $$quiet build
diff --git a/pkgs/development/interpreters/python/cpython/3.5/use-correct-tcl-tk-on-darwin.patch b/pkgs/development/interpreters/python/cpython/3.5/use-correct-tcl-tk-on-darwin.patch
deleted file mode 100644
index b73f62b97ec50..0000000000000
--- a/pkgs/development/interpreters/python/cpython/3.5/use-correct-tcl-tk-on-darwin.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/setup.py b/setup.py
-index 2779658..902d0eb 100644
---- a/setup.py
-+++ b/setup.py
-@@ -1699,9 +1699,6 @@ class PyBuildExt(build_ext):
-         # Rather than complicate the code below, detecting and building
-         # AquaTk is a separate method. Only one Tkinter will be built on
-         # Darwin - either AquaTk, if it is found, or X11 based Tk.
--        if (host_platform == 'darwin' and
--            self.detect_tkinter_darwin(inc_dirs, lib_dirs)):
--            return
-
-         # Assume we haven't found any of the libraries or include files
-         # The versions with dots are used on Unix, and the versions without
-@@ -1747,22 +1744,6 @@ class PyBuildExt(build_ext):
-             if dir not in include_dirs:
-                 include_dirs.append(dir)
-
--        # Check for various platform-specific directories
--        if host_platform == 'sunos5':
--            include_dirs.append('/usr/openwin/include')
--            added_lib_dirs.append('/usr/openwin/lib')
--        elif os.path.exists('/usr/X11R6/include'):
--            include_dirs.append('/usr/X11R6/include')
--            added_lib_dirs.append('/usr/X11R6/lib64')
--            added_lib_dirs.append('/usr/X11R6/lib')
--        elif os.path.exists('/usr/X11R5/include'):
--            include_dirs.append('/usr/X11R5/include')
--            added_lib_dirs.append('/usr/X11R5/lib')
--        else:
--            # Assume default location for X11
--            include_dirs.append('/usr/X11/include')
--            added_lib_dirs.append('/usr/X11/lib')
--
-         # If Cygwin, then verify that X is installed before proceeding
-         if host_platform == 'cygwin':
-             x11_inc = find_file('X11/Xlib.h', [], include_dirs)
-@@ -1786,10 +1767,6 @@ class PyBuildExt(build_ext):
-         if host_platform in ['aix3', 'aix4']:
-             libs.append('ld')
-
--        # Finally, link with the X11 libraries (not appropriate on cygwin)
--        if host_platform != "cygwin":
--            libs.append('X11')
--
-         ext = Extension('_tkinter', ['_tkinter.c', 'tkappinit.c'],
-                         define_macros=[('WITH_APPINIT', 1)] + defs,
-                         include_dirs = include_dirs,
diff --git a/pkgs/development/interpreters/python/cpython/3.6/find_library.patch b/pkgs/development/interpreters/python/cpython/3.6/find_library.patch
deleted file mode 100644
index 97fb66662d030..0000000000000
--- a/pkgs/development/interpreters/python/cpython/3.6/find_library.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 9b5a023a5dc3127da15253f7acad71019395ebe1 Mon Sep 17 00:00:00 2001
-From: Pablo Galindo <Pablogsal@gmail.com>
-Date: Thu, 8 Oct 2020 19:50:37 +0100
-Subject: [PATCH] [3.7] bpo-41976: Fix the fallback to gcc of
- ctypes.util.find_library when using gcc>9 (GH-22598). (GH-22601)
-
-(cherry picked from commit 27ac19cca2c639caaf6fedf3632fe6beb265f24f)
-
-Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>
----
- Lib/ctypes/test/test_find.py                  | 12 ++++++-
- Lib/ctypes/util.py                            | 32 +++++++++++++++----
- .../2020-10-08-18-22-28.bpo-41976.Svm0wb.rst  |  3 ++
- 3 files changed, 39 insertions(+), 8 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Library/2020-10-08-18-22-28.bpo-41976.Svm0wb.rst
-
-diff --git a/Lib/ctypes/test/test_find.py b/Lib/ctypes/test/test_find.py
-index b99fdcba7b28f..92ac1840ad7d4 100644
---- a/Lib/ctypes/test/test_find.py
-+++ b/Lib/ctypes/test/test_find.py
-@@ -1,4 +1,5 @@
- import unittest
-+import unittest.mock
- import os.path
- import sys
- import test.support
-@@ -72,7 +73,7 @@ def test_shell_injection(self):
- 
- @unittest.skipUnless(sys.platform.startswith('linux'),
-                      'Test only valid for Linux')
--class LibPathFindTest(unittest.TestCase):
-+class FindLibraryLinux(unittest.TestCase):
-     def test_find_on_libpath(self):
-         import subprocess
-         import tempfile
-@@ -111,6 +112,15 @@ def test_find_on_libpath(self):
-                 # LD_LIBRARY_PATH)
-                 self.assertEqual(find_library(libname), 'lib%s.so' % libname)
- 
-+    def test_find_library_with_gcc(self):
-+        with unittest.mock.patch("ctypes.util._findSoname_ldconfig", lambda *args: None):
-+            self.assertNotEqual(find_library('c'), None)
-+
-+    def test_find_library_with_ld(self):
-+        with unittest.mock.patch("ctypes.util._findSoname_ldconfig", lambda *args: None), \
-+             unittest.mock.patch("ctypes.util._findLib_gcc", lambda *args: None):
-+            self.assertNotEqual(find_library('c'), None)
-+
- 
- if __name__ == "__main__":
-     unittest.main()
-diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
-index 97973bce001d9..0c2510e1619c8 100644
---- a/Lib/ctypes/util.py
-+++ b/Lib/ctypes/util.py
-@@ -93,6 +93,12 @@ def find_library(name):
-     # Andreas Degert's find functions, using gcc, /sbin/ldconfig, objdump
-     import re, tempfile
- 
-+    def _is_elf(filename):
-+        "Return True if the given file is an ELF file"
-+        elf_header = b'\x7fELF'
-+        with open(filename, 'br') as thefile:
-+            return thefile.read(4) == elf_header
-+
-     def _findLib_gcc(name):
-         # Run GCC's linker with the -t (aka --trace) option and examine the
-         # library name it prints out. The GCC command will fail because we
-@@ -299,17 +312,22 @@ def _findLib_ld(name):
-                                      stderr=subprocess.PIPE,
-                                      universal_newlines=True)
-                 out, _ = p.communicate()
--                res = re.search(expr, os.fsdecode(out))
--                if res:
--                    result = res.group(0)
--            except Exception as e:
-+                res = re.findall(expr, os.fsdecode(out))
-+                for file in res:
-+                    # Check if the given file is an elf file: gcc can report
-+                    # some files that are linker scripts and not actual
-+                    # shared objects. See bpo-41976 for more details
-+                    if not _is_elf(file):
-+                        continue
-+                    return os.fsdecode(file)
-+            except Exception:
-                 pass  # result will be None
-             return result
- 
-         def find_library(name):
-             # See issue #9998
-             return _findSoname_ldconfig(name) or \
--                   _get_soname(_findLib_gcc(name) or _findLib_ld(name))
-+                   _get_soname(_findLib_gcc(name)) or _get_soname(_findLib_ld(name))
- 
- ################################################################
- # test code
-diff --git a/Misc/NEWS.d/next/Library/2020-10-08-18-22-28.bpo-41976.Svm0wb.rst b/Misc/NEWS.d/next/Library/2020-10-08-18-22-28.bpo-41976.Svm0wb.rst
-new file mode 100644
-index 0000000000000..c8b3fc771845e
---- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2020-10-08-18-22-28.bpo-41976.Svm0wb.rst
-@@ -0,0 +1,3 @@
-+Fixed a bug that was causing :func:`ctypes.util.find_library` to return
-+``None`` when triying to locate a library in an environment when gcc>=9 is
-+available and ``ldconfig`` is not. Patch by Pablo Galindo
diff --git a/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch b/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch
deleted file mode 100644
index d324d10b39fc2..0000000000000
--- a/pkgs/development/interpreters/python/cpython/3.6/fix-finding-headers-when-cross-compiling.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 45dfbbb4f5b67ab83e4365564ea569334e979f8e Mon Sep 17 00:00:00 2001
-From: Ben Wolsieffer <benwolsieffer@gmail.com>
-Date: Fri, 25 Sep 2020 16:49:16 -0400
-Subject: [PATCH] Fix finding headers when cross compiling
-
-When cross-compiling third-party extensions, get_python_inc() may be called to
-return the path to Python's headers. However, it uses the sys.prefix or
-sys.exec_prefix of the build Python, which returns incorrect paths when
-cross-compiling (paths pointing to build system headers).
-
-To fix this, we use the INCLUDEPY and CONFINCLUDEPY conf variables, which can
-be configured to point at host Python by setting _PYTHON_SYSCONFIGDATA_NAME.
-The existing behavior is maintained on non-POSIX platforms or if a prefix is
-manually specified.
----
- Lib/distutils/sysconfig.py | 14 ++++++++++----
- 1 file changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/Lib/distutils/sysconfig.py b/Lib/distutils/sysconfig.py
-index 2bcd1dd288..567375e488 100644
---- a/Lib/distutils/sysconfig.py
-+++ b/Lib/distutils/sysconfig.py
-@@ -84,8 +84,6 @@ def get_python_inc(plat_specific=0, prefix=None):
-     If 'prefix' is supplied, use it instead of sys.base_prefix or
-     sys.base_exec_prefix -- i.e., ignore 'plat_specific'.
-     """
--    if prefix is None:
--        prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
-     if os.name == "posix":
-         if python_build:
-             # Assume the executable is in the build directory.  The
-@@ -98,9 +96,17 @@ def get_python_inc(plat_specific=0, prefix=None):
-             else:
-                 incdir = os.path.join(get_config_var('srcdir'), 'Include')
-                 return os.path.normpath(incdir)
--        python_dir = 'python' + get_python_version() + build_flags
--        return os.path.join(prefix, "include", python_dir)
-+        if prefix is None:
-+          if plat_specific:
-+            return get_config_var('CONFINCLUDEPY')
-+          else:
-+            return get_config_var('INCLUDEPY')
-+        else:
-+          python_dir = 'python' + get_python_version() + build_flags
-+          return os.path.join(prefix, "include", python_dir)
-     elif os.name == "nt":
-+        if prefix is None:
-+          prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX
-         return os.path.join(prefix, "include")
-     else:
-         raise DistutilsPlatformError(
--- 
-2.28.0
-
diff --git a/pkgs/development/interpreters/python/cpython/3.6/use-correct-tcl-tk-on-darwin.patch b/pkgs/development/interpreters/python/cpython/3.6/use-correct-tcl-tk-on-darwin.patch
deleted file mode 100644
index b73f62b97ec50..0000000000000
--- a/pkgs/development/interpreters/python/cpython/3.6/use-correct-tcl-tk-on-darwin.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/setup.py b/setup.py
-index 2779658..902d0eb 100644
---- a/setup.py
-+++ b/setup.py
-@@ -1699,9 +1699,6 @@ class PyBuildExt(build_ext):
-         # Rather than complicate the code below, detecting and building
-         # AquaTk is a separate method. Only one Tkinter will be built on
-         # Darwin - either AquaTk, if it is found, or X11 based Tk.
--        if (host_platform == 'darwin' and
--            self.detect_tkinter_darwin(inc_dirs, lib_dirs)):
--            return
-
-         # Assume we haven't found any of the libraries or include files
-         # The versions with dots are used on Unix, and the versions without
-@@ -1747,22 +1744,6 @@ class PyBuildExt(build_ext):
-             if dir not in include_dirs:
-                 include_dirs.append(dir)
-
--        # Check for various platform-specific directories
--        if host_platform == 'sunos5':
--            include_dirs.append('/usr/openwin/include')
--            added_lib_dirs.append('/usr/openwin/lib')
--        elif os.path.exists('/usr/X11R6/include'):
--            include_dirs.append('/usr/X11R6/include')
--            added_lib_dirs.append('/usr/X11R6/lib64')
--            added_lib_dirs.append('/usr/X11R6/lib')
--        elif os.path.exists('/usr/X11R5/include'):
--            include_dirs.append('/usr/X11R5/include')
--            added_lib_dirs.append('/usr/X11R5/lib')
--        else:
--            # Assume default location for X11
--            include_dirs.append('/usr/X11/include')
--            added_lib_dirs.append('/usr/X11/lib')
--
-         # If Cygwin, then verify that X is installed before proceeding
-         if host_platform == 'cygwin':
-             x11_inc = find_file('X11/Xlib.h', [], include_dirs)
-@@ -1786,10 +1767,6 @@ class PyBuildExt(build_ext):
-         if host_platform in ['aix3', 'aix4']:
-             libs.append('ld')
-
--        # Finally, link with the X11 libraries (not appropriate on cygwin)
--        if host_platform != "cygwin":
--            libs.append('X11')
--
-         ext = Extension('_tkinter', ['_tkinter.c', 'tkappinit.c'],
-                         define_macros=[('WITH_APPINIT', 1)] + defs,
-                         include_dirs = include_dirs,
diff --git a/pkgs/development/interpreters/python/cpython/3.6/profile-task.patch b/pkgs/development/interpreters/python/cpython/3.7/profile-task.patch
similarity index 100%
rename from pkgs/development/interpreters/python/cpython/3.6/profile-task.patch
rename to pkgs/development/interpreters/python/cpython/3.7/profile-task.patch
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index d6e8f935380cb..8d55ea6c39cb0 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -121,7 +121,7 @@ let
   ];
 
   buildInputs = filter (p: p != null) ([
-    zlib bzip2 expat xz libffi gdbm sqlite readline ncurses openssl' ]
+    zlib bzip2 expat xz libffi libxcrypt gdbm sqlite readline ncurses openssl' ]
     ++ optionals x11Support [ tcl tk libX11 xorgproto ]
     ++ optionals (bluezSupport && stdenv.isLinux) [ bluez ]
     ++ optionals stdenv.isDarwin [ configd ])
@@ -180,7 +180,7 @@ let
       if isDarwin then "darwin"
       else "${multiarchCpu}-${parsed.kernel.name}-${pythonAbiName}";
 
-    abiFlags = optionalString (isPy36 || isPy37) "m";
+    abiFlags = optionalString isPy37 "m";
 
     # https://github.com/python/cpython/blob/e488e300f5c01289c10906c2e53a8e43d6de32d8/configure.ac#L78
     pythonSysconfigdataName = "_sysconfigdata_${abiFlags}_${parsed.kernel.name}_${multiarch}";
@@ -214,7 +214,19 @@ in with passthru; stdenv.mkDerivation {
     substituteInPlace setup.py --replace /Library/Frameworks /no-such-path
   '';
 
-  patches = [
+  patches = optionals (version == "3.10.9") [
+    # https://github.com/python/cpython/issues/100160
+    ./3.10/asyncio-deprecation.patch
+  ] ++ optionals (version == "3.11.1") [
+    # https://github.com/python/cpython/issues/100160
+    (fetchpatch {
+      name = "asyncio-deprecation-3.11.patch";
+      url = "https://github.com/python/cpython/commit/3fae04b10e2655a20a3aadb5e0d63e87206d0c67.diff";
+      revert = true;
+      excludes = [ "Misc/NEWS.d/*" ];
+      sha256 = "sha256-PmkXf2D9trtW1gXZilRIWgdg2Y47JfELq1z4DuG3wJY=";
+    })
+  ] ++ [
     # Disable the use of ldconfig in ctypes.util.find_library (since
     # ldconfig doesn't work on NixOS), and don't use
     # ctypes.util.find_library during the loading of the uuid module
@@ -228,13 +240,7 @@ in with passthru; stdenv.mkDerivation {
   ] ++ optionals mimetypesSupport [
     # Make the mimetypes module refer to the right file
     ./mimetypes.patch
-  ] ++ optionals (isPy35 || isPy36) [
-    # Determinism: Write null timestamps when compiling python files.
-    ./3.5/force_bytecode_determinism.patch
-  ] ++ optionals isPy35 [
-    # Backports support for LD_LIBRARY_PATH from 3.6
-    ./3.5/ld_library_path.patch
-  ] ++ optionals (isPy35 || isPy36 || isPy37) [
+  ] ++ optionals isPy37 [
     # Backport a fix for discovering `rpmbuild` command when doing `python setup.py bdist_rpm` to 3.5, 3.6, 3.7.
     # See: https://bugs.python.org/issue11122
     ./3.7/fix-hardcoded-path-checking-for-rpmbuild.patch
@@ -250,12 +256,7 @@ in with passthru; stdenv.mkDerivation {
     ./3.11/darwin-libutil.patch
   ] ++ optionals (pythonOlder "3.8") [
     # Backport from CPython 3.8 of a good list of tests to run for PGO.
-    (
-      if isPy36 || isPy37 then
-        ./3.6/profile-task.patch
-      else
-        ./3.5/profile-task.patch
-    )
+    ./3.7/profile-task.patch
   ] ++ optionals (pythonAtLeast "3.9" && pythonOlder "3.11" && stdenv.isDarwin) [
     # Stop checking for TCL/TK in global macOS locations
     ./3.9/darwin-tcl-tk.patch
@@ -265,9 +266,7 @@ in with passthru; stdenv.mkDerivation {
     # only works for GCC and Apple Clang. This makes distutils to call C++
     # compiler when needed.
     (
-      if isPy35 then
-        ./3.5/python-3.x-distutils-C++.patch
-      else if pythonAtLeast "3.7" && pythonOlder "3.11" then
+      if pythonAtLeast "3.7" && pythonOlder "3.11" then
         ./3.7/python-3.x-distutils-C++.patch
       else if pythonAtLeast "3.11" then
         ./3.11/python-3.x-distutils-C++.patch
@@ -277,19 +276,11 @@ in with passthru; stdenv.mkDerivation {
           sha256 = "1h18lnpx539h5lfxyk379dxwr8m2raigcjixkf133l4xy3f4bzi2";
         }
     )
-  ] ++ [
+  ] ++ optionals (pythonOlder "3.12") [
     # LDSHARED now uses $CC instead of gcc. Fixes cross-compilation of extension modules.
     ./3.8/0001-On-all-posix-systems-not-just-Darwin-set-LDSHARED-if.patch
     # Use sysconfigdata to find headers. Fixes cross-compilation of extension modules.
-    (
-      if isPy36 then
-        ./3.6/fix-finding-headers-when-cross-compiling.patch
-      else
-        ./3.7/fix-finding-headers-when-cross-compiling.patch
-    )
-  ] ++ optionals (isPy36) [
-    # Backport a fix for ctypes.util.find_library.
-    ./3.6/find_library.patch
+    ./3.7/fix-finding-headers-when-cross-compiling.patch
   ];
 
   postPatch = ''
@@ -329,6 +320,9 @@ in with passthru; stdenv.mkDerivation {
     "--enable-loadable-sqlite-extensions"
   ] ++ optionals (openssl' != null) [
     "--with-openssl=${openssl'.dev}"
+  ] ++ optionals (libxcrypt != null) [
+    "CFLAGS=-I${libxcrypt}/include"
+    "LIBS=-L${libxcrypt}/lib"
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_buggy_getaddrinfo=no"
     # Assume little-endian IEEE 754 floating point when cross compiling
@@ -354,14 +348,11 @@ in with passthru; stdenv.mkDerivation {
     # Never even try to use lchmod on linux,
     # don't rely on detecting glibc-isms.
     "ac_cv_func_lchmod=no"
-  ] ++ optionals (libxcrypt != null) [
-    "CFLAGS=-I${libxcrypt}/include"
-    "LIBS=-L${libxcrypt}/lib"
   ] ++ optionals tzdataSupport [
     "--with-tzpath=${tzdata}/share/zoneinfo"
   ] ++ optional static "LDFLAGS=-static";
 
-  preConfigure = ''
+  preConfigure = optionalString (pythonOlder "3.12") ''
     for i in /usr /sw /opt /pkg; do	# improve purity
       substituteInPlace ./setup.py --replace $i /no-such-path
     done
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 0c58d067f7e1c..18282bc6d26c5 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -84,13 +84,12 @@
         });
     in rec {
         isPy27 = pythonVersion == "2.7";
-        isPy35 = pythonVersion == "3.5";
-        isPy36 = pythonVersion == "3.6";
         isPy37 = pythonVersion == "3.7";
         isPy38 = pythonVersion == "3.8";
         isPy39 = pythonVersion == "3.9";
         isPy310 = pythonVersion == "3.10";
         isPy311 = pythonVersion == "3.11";
+        isPy312 = pythonVersion == "3.12";
         isPy2 = lib.strings.substring 0 1 pythonVersion == "2";
         isPy3 = lib.strings.substring 0 1 pythonVersion == "3";
         isPy3k = isPy3;
@@ -121,19 +120,19 @@
       sourceVersion = {
         major = "3";
         minor = "9";
-        patch = "15";
+        patch = "16";
         suffix = "";
       };
-      sha256 = "sha256-Etr/aAlSjZ9hVCFpUEI8njDw5HM2y1fGqgtDh91etLI=";
+      sha256 = "sha256-It3cCZJG3SdgZlVh6K23OU6gzEOnJoTGSA+TgPd4ZDk=";
     };
     python310 = {
       sourceVersion = {
         major = "3";
         minor = "10";
-        patch = "8";
+        patch = "9";
         suffix = "";
       };
-      sha256 = "sha256-ajDs3lnEcEgBPrWmWMm13sJ3ID0nk2Z/V433Zx9/A/M=";
+      sha256 = "sha256-WuA+MIJgFkuro5kh/bTb+ObQPYI1qTnUWCsz8LXkaoM=";
     };
   };
 
@@ -203,6 +202,19 @@ in {
     inherit passthruFun;
   };
 
+  python312 = callPackage ./cpython {
+    self = __splicedPackages.python312;
+    sourceVersion = {
+      major = "3";
+      minor = "12";
+      patch = "0";
+      suffix = "a3";
+    };
+    sha256 = "sha256-G2SzB14KkkGXTlgOCbCckRehxOK+aYA5IB7x2Kc0U9E=";
+    inherit (darwin) configd;
+    inherit passthruFun;
+  };
+
   # Minimal versions of Python (built without optional dependencies)
   python3Minimal = (callPackage ./cpython ({
     self = __splicedPackages.python3Minimal;
diff --git a/pkgs/development/interpreters/python/python-packages-base.nix b/pkgs/development/interpreters/python/python-packages-base.nix
index a63ece3c23699..81ad194a25c7c 100644
--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@@ -8,7 +8,7 @@ self:
 
 let
   inherit (self) callPackage;
-  inherit (python.passthru) isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy310 isPy311 isPy3k isPyPy pythonAtLeast pythonOlder;
+  inherit (python.passthru) isPy27 isPy37 isPy38 isPy39 isPy310 isPy311 isPy3k isPyPy pythonAtLeast pythonOlder;
 
   namePrefix = python.libPrefix + "-";
 
@@ -87,7 +87,7 @@ let
 in {
 
   inherit lib pkgs stdenv;
-  inherit (python.passthru) isPy27 isPy35 isPy36 isPy37 isPy38 isPy39 isPy310 isPy311 isPy3k isPyPy pythonAtLeast pythonOlder;
+  inherit (python.passthru) isPy27 isPy37 isPy38 isPy39 isPy310 isPy311 isPy3k isPyPy pythonAtLeast pythonOlder;
   inherit buildPythonPackage buildPythonApplication;
   inherit fetchPypi;
   inherit hasPythonModule requiredPythonModules makePythonPath disabled disabledIf;
diff --git a/pkgs/development/libraries/Xaw3d/default.nix b/pkgs/development/libraries/Xaw3d/default.nix
index 3ec220ca80de9..f358a59ad62d1 100644
--- a/pkgs/development/libraries/Xaw3d/default.nix
+++ b/pkgs/development/libraries/Xaw3d/default.nix
@@ -6,10 +6,12 @@
 , bison
 , flex
 , pkg-config
-, xlibsWrapper
+, libXext
 , libXmu
 , libXpm
 , libXp
+, libXt
+, xorgproto
 }:
 
 stdenv.mkDerivation rec {
@@ -22,8 +24,8 @@ stdenv.mkDerivation rec {
   };
   dontUseImakeConfigure = true;
   nativeBuildInputs = [ pkg-config bison flex imake gccmakedep ];
-  buildInputs = [ libXpm libXp ];
-  propagatedBuildInputs = [ xlibsWrapper libXmu ];
+  buildInputs = [ libXext libXpm libXp ];
+  propagatedBuildInputs = [ libXmu libXt xorgproto ];
 
   meta = with lib; {
     description = "3D widget set based on the Athena Widget set";
diff --git a/pkgs/development/libraries/cmocka/default.nix b/pkgs/development/libraries/cmocka/default.nix
index 9bfbc410c0072..ed78f4f9ec84a 100644
--- a/pkgs/development/libraries/cmocka/default.nix
+++ b/pkgs/development/libraries/cmocka/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, cmake }:
+{ fetchurl, fetchpatch, lib, stdenv, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "cmocka";
@@ -10,6 +10,14 @@ stdenv.mkDerivation rec {
     sha256 = "1dm8pdvkyfa8dsbz9bpq7wwgixjij4sii9bbn5sgvqjm5ljdik7h";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "musl-uintptr.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/cmocka/musl_uintptr.patch?id=6a15dd0d0ba9cc354a621fb359ca5e315ff2eabd";
+      sha256 = "sha256-fhb2Tax30kRTGuaKvzSzglSd/ntxiNeGFJt5I8poa24=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index a566062c0ee47..12f46af022fc6 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -56,11 +56,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.74.1";
+  version = "2.74.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "CrmBYY0dtHhF5WQXsNfBI/gaNCeyuck/Wkb/W7uWSWQ=";
+    sha256 = "6bxB7NlpDZvGqXDMc4ARm4KOW2pLFsOTxjiz3CuHy8s=";
   };
 
   patches = lib.optionals stdenv.isDarwin [
@@ -118,14 +118,6 @@ stdenv.mkDerivation (finalAttrs: {
     # Disable flaky test.
     # https://gitlab.gnome.org/GNOME/glib/-/issues/820
     ./skip-timer-test.patch
-
-    # Fix infinite loop (e.g. in gnome-keyring)
-    # https://github.com/NixOS/nixpkgs/pull/197754#issuecomment-1312805358
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3039
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/2a36bb4b7e46f9ac043561c61f9a790786a5440c.patch";
-      sha256 = "b77Hxt6WiLxIGqgAj9ZubzPWrWmorcUOEe/dp01BcXA=";
-    })
   ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/glibc/2.35-make-4.4.patch b/pkgs/development/libraries/glibc/2.35-make-4.4.patch
deleted file mode 100644
index 346c141d3b368..0000000000000
--- a/pkgs/development/libraries/glibc/2.35-make-4.4.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=2d7ed98add14f75041499ac189696c9bd3d757fe
---- a/Makeconfig
-+++ b/Makeconfig
-@@ -43,6 +43,22 @@ else
- $(error objdir must be defined by the build-directory Makefile)
- endif
- 
-+# Did we request 'make -s' run? "yes" or "no".
-+# Starting from make-4.4 MAKEFLAGS now contains long
-+# options like '--shuffle'. To detect presence of 's'
-+# we pick first word with short options. Long options
-+# are guaranteed to come after whitespace. We use '-'
-+# prefix to always have a word before long options
-+# even if no short options were passed.
-+# Typical MAKEFLAGS values to watch for:
-+#   "rs --shuffle=42" (silent)
-+#   " --shuffle" (not silent)
-+ifeq ($(findstring s, $(firstword -$(MAKEFLAGS))),)
-+silent-make := no
-+else
-+silent-make := yes
-+endif
-+
- # Root of the sysdeps tree.
- sysdep_dir := $(..)sysdeps
- export sysdep_dir := $(sysdep_dir)
-@@ -917,7 +933,7 @@ endif
- # umpteen zillion filenames along with it (we use `...' instead)
- # but we don't want this echoing done when the user has said
- # he doesn't want to see commands echoed by using -s.
--ifneq	"$(findstring s,$(MAKEFLAGS))" ""	# if -s
-+ifeq ($(silent-make),yes)			# if -s
- +cmdecho	:= echo >/dev/null
- else						# not -s
- +cmdecho	:= echo
---- a/Makerules
-+++ b/Makerules
-@@ -794,7 +794,7 @@ endif
- # Maximize efficiency by minimizing the number of rules.
- .SUFFIXES:	# Clear the suffix list.  We don't use suffix rules.
- # Don't define any builtin rules.
--MAKEFLAGS := $(MAKEFLAGS)r
-+MAKEFLAGS := $(MAKEFLAGS) -r
- 
- # Generic rule for making directories.
- %/:
-@@ -811,7 +811,7 @@ MAKEFLAGS := $(MAKEFLAGS)r
- .PRECIOUS: $(foreach l,$(libtypes),$(patsubst %,$(common-objpfx)$l,c))
- 
- # Use the verbose option of ar and tar when not running silently.
--ifeq	"$(findstring s,$(MAKEFLAGS))" ""	# if not -s
-+ifeq ($(silent-make),no)			# if not -s
- verbose := v
- else	   					# -s
- verbose	:=
---- a/elf/rtld-Rules
-+++ b/elf/rtld-Rules
-@@ -52,7 +52,7 @@ $(objpfx)rtld-libc.a: $(foreach dir,$(rtld-subdirs),\
- 	mv -f $@T $@
- 
- # Use the verbose option of ar and tar when not running silently.
--ifeq	"$(findstring s,$(MAKEFLAGS))" ""	# if not -s
-+ifeq ($(silent-make),no)			# if not -s
- verbose := v
- else						# -s
- verbose	:=
diff --git a/pkgs/development/libraries/glibc/2.35-master.patch.gz b/pkgs/development/libraries/glibc/2.35-master.patch.gz
index 24939e1c08995..7b8423c5b61b8 100644
Binary files a/pkgs/development/libraries/glibc/2.35-master.patch.gz and b/pkgs/development/libraries/glibc/2.35-master.patch.gz differ
diff --git a/pkgs/development/libraries/glibc/allow-kernel-2.6.32.patch b/pkgs/development/libraries/glibc/allow-kernel-2.6.32.patch
deleted file mode 100644
index ce18b874c4272..0000000000000
--- a/pkgs/development/libraries/glibc/allow-kernel-2.6.32.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-diff --git a/sysdeps/unix/sysv/linux/configure b/sysdeps/unix/sysv/linux/configure
-index cace758c01..38fe7fe0b0 100644
---- a/sysdeps/unix/sysv/linux/configure
-+++ b/sysdeps/unix/sysv/linux/configure
-@@ -69,7 +69,7 @@ fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for kernel header at least $minimum_kernel" >&5
- $as_echo_n "checking for kernel header at least $minimum_kernel... " >&6; }
- decnum=`echo "$minimum_kernel.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/(\1 * 65536 + \2 * 256 + \3)/'`;
--abinum=`echo "$minimum_kernel.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/\1,\2,\3/'`;
-+abinum=`echo "2.6.32.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/\1,\2,\3/'`;
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- /* end confdefs.h.  */
- #include <linux/version.h>
-diff --git a/sysdeps/unix/sysv/linux/configure.ac b/sysdeps/unix/sysv/linux/configure.ac
-index 13abda0a51..6abc12eaed 100644
---- a/sysdeps/unix/sysv/linux/configure.ac
-+++ b/sysdeps/unix/sysv/linux/configure.ac
-@@ -50,7 +50,7 @@ fi
- AC_MSG_CHECKING(for kernel header at least $minimum_kernel)
- changequote(,)dnl
- decnum=`echo "$minimum_kernel.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/(\1 * 65536 + \2 * 256 + \3)/'`;
--abinum=`echo "$minimum_kernel.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/\1,\2,\3/'`;
-+abinum=`echo "2.6.32.0.0.0" | sed 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/\1,\2,\3/'`;
- changequote([,])dnl
- AC_TRY_COMPILE([#include <linux/version.h>
- #if LINUX_VERSION_CODE < $decnum
-diff --git a/sysdeps/unix/sysv/linux/dl-osinfo.h b/sysdeps/unix/sysv/linux/dl-osinfo.h
-index 823cd8224d..482caaeeec 100644
---- a/sysdeps/unix/sysv/linux/dl-osinfo.h
-+++ b/sysdeps/unix/sysv/linux/dl-osinfo.h
-@@ -39,7 +39,7 @@
- 	  GLRO(dl_osversion) = version;					      \
- 									      \
- 	/* Now we can test with the required version.  */		      \
--	if (__LINUX_KERNEL_VERSION > 0 && version < __LINUX_KERNEL_VERSION)   \
-+	if (__LINUX_KERNEL_VERSION > 0 && version < __LINUX_KERNEL_VERSION && version != 0x020620)   \
- 	  /* Not sufficent.  */						      \
- 	  FATAL ("FATAL: kernel too old\n");				      \
-       }									      \
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index ad2a8ae7ab64f..61c0c92d5280a 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -45,7 +45,7 @@
 
 let
   version = "2.35";
-  patchSuffix = "-163";
+  patchSuffix = "-224";
   sha256 = "sha256-USNzL2tnzNMZMF79OZlx1YWSEivMKmUYob0lEN0M9S4=";
 in
 
@@ -72,8 +72,8 @@ stdenv.mkDerivation ({
        */
       ./2.35-master.patch.gz
 
-      /* Can be removed after next snapshot update or release update.  */
-      ./2.35-make-4.4.patch
+      /* Revert this patch contained in the previous bundle.  For now, until we know more. */
+      ./revert-mktime.patch
 
       /* Allow NixOS and Nix to handle the locale-archive. */
       ./nix-locale-archive.patch
@@ -89,36 +89,6 @@ stdenv.mkDerivation ({
          patch extends the search path by "/run/current-system/sw/bin". */
       ./fix_path_attribute_in_getconf.patch
 
-      /* Allow running with RHEL 6 -like kernels.  The patch adds an exception
-        for glibc to accept 2.6.32 and to tag the ELFs as 2.6.32-compatible
-        (otherwise the loader would refuse libc).
-        Note that glibc will fully work only on their heavily patched kernels
-        and we lose early mismatch detection on 2.6.32.
-
-        On major glibc updates we should check that the patched kernel supports
-        all the required features.  ATM it's verified up to glibc-2.26-131.
-        # HOWTO: check glibc sources for changes in kernel requirements
-        git log -p glibc-2.25.. sysdeps/unix/sysv/linux/x86_64/kernel-features.h sysdeps/unix/sysv/linux/kernel-features.h
-        # get kernel sources (update the URL)
-        mkdir tmp && cd tmp
-        curl http://vault.centos.org/6.9/os/Source/SPackages/kernel-2.6.32-696.el6.src.rpm | rpm2cpio - | cpio -idmv
-        tar xf linux-*.bz2
-        # check syscall presence, for example
-        less linux-*?/arch/x86/kernel/syscall_table_32.S
-       */
-      ./allow-kernel-2.6.32.patch
-
-      /* Provide a fallback for missing prlimit64 syscall on RHEL 6 -like
-         kernels.
-
-         This patch is maintained by @veprbl. If it gives you trouble, feel
-         free to ping me, I'd be happy to help.
-       */
-      (fetchurl {
-        url = "https://git.savannah.gnu.org/cgit/guix.git/plain/gnu/packages/patches/glibc-reinstate-prlimit64-fallback.patch?id=eab07e78b691ae7866267fc04d31c7c3ad6b0eeb";
-        sha256 = "091bk3kyrx1gc380gryrxjzgcmh1ajcj8s2rjhp2d2yzd5mpd5ps";
-      })
-
       ./fix-x64-abi.patch
 
       /* https://github.com/NixOS/nixpkgs/pull/137601 */
@@ -175,7 +145,7 @@ stdenv.mkDerivation ({
       # Enable Intel Control-flow Enforcement Technology (CET) support
       "--enable-cet"
     ] ++ lib.optionals withLinuxHeaders [
-      "--enable-kernel=3.2.0" # can't get below with glibc >= 2.26
+      "--enable-kernel=3.10.0" # RHEL 7 and derivatives, seems oldest still supported kernel
     ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       (lib.flip lib.withFeature "fp"
          (stdenv.hostPlatform.gcc.float or (stdenv.hostPlatform.parsed.abi.float or "hard") == "soft"))
diff --git a/pkgs/development/libraries/glibc/revert-mktime.patch b/pkgs/development/libraries/glibc/revert-mktime.patch
new file mode 100644
index 0000000000000..d691213e86576
--- /dev/null
+++ b/pkgs/development/libraries/glibc/revert-mktime.patch
@@ -0,0 +1,73 @@
+commit f6d4c1ac648c4ff8baad94500df0bb13108a4f79
+Author: Paul Eggert <eggert@cs.ucla.edu>
+Date:   Thu Sep 8 20:08:32 2022 -0500
+
+    REVERT: mktime: improve heuristic for ca-1986 Indiana DST
+    
+    This patch syncs mktime.c from Gnulib, fixing a
+    problem reported by Mark Krenz <https://bugs.gnu.org/48085>,
+    and it should fix BZ#29035 too.
+    * time/mktime.c (__mktime_internal): Be more generous about
+    accepting arguments with the wrong value of tm_isdst, by falling
+    back to a one-hour DST difference if we find no nearby DST that is
+    unusual.  This fixes a problem where "1986-04-28 00:00 EDT" was
+    rejected when TZ="America/Indianapolis" because the nearest DST
+    timestamp occurred in 1970, a temporal distance too great for the
+    old heuristic.  This also also narrows the search a bit, which
+    is a minor performance win.
+    
+    (cherry picked from commit 83859e1115269cf56d21669361d4ddbe2687831c)
+
+diff --git b/time/mktime.c a/time/mktime.c
+index e9a6006710..494c89bf54 100644
+--- b/time/mktime.c
++++ a/time/mktime.c
+@@ -429,13 +429,8 @@ __mktime_internal (struct tm *tp,
+ 	 time with the right value, and use its UTC offset.
+ 
+ 	 Heuristic: probe the adjacent timestamps in both directions,
+-	 looking for the desired isdst.  If none is found within a
+-	 reasonable duration bound, assume a one-hour DST difference.
+-	 This should work for all real time zone histories in the tz
+-	 database.  */
+-
+-      /* +1 if we wanted standard time but got DST, -1 if the reverse.  */
+-      int dst_difference = (isdst == 0) - (tm.tm_isdst == 0);
++	 looking for the desired isdst.  This should work for all real
++	 time zone histories in the tz database.  */
+ 
+       /* Distance between probes when looking for a DST boundary.  In
+ 	 tzdata2003a, the shortest period of DST is 601200 seconds
+@@ -446,14 +441,12 @@ __mktime_internal (struct tm *tp,
+ 	 periods when probing.  */
+       int stride = 601200;
+ 
+-      /* In TZDB 2021e, the longest period of DST (or of non-DST), in
+-	 which the DST (or adjacent DST) difference is not one hour,
+-	 is 457243209 seconds: e.g., America/Cambridge_Bay with leap
+-	 seconds, starting 1965-10-31 00:00 in a switch from
+-	 double-daylight time (-05) to standard time (-07), and
+-	 continuing to 1980-04-27 02:00 in a switch from standard time
+-	 (-07) to daylight time (-06).  */
+-      int duration_max = 457243209;
++      /* The longest period of DST in tzdata2003a is 536454000 seconds
++	 (e.g., America/Jujuy starting 1946-10-01 01:00).  The longest
++	 period of non-DST is much longer, but it makes no real sense
++	 to search for more than a year of non-DST, so use the DST
++	 max.  */
++      int duration_max = 536454000;
+ 
+       /* Search in both directions, so the maximum distance is half
+ 	 the duration; add the stride to avoid off-by-1 problems.  */
+@@ -490,11 +483,6 @@ __mktime_internal (struct tm *tp,
+ 	      }
+ 	  }
+ 
+-      /* No unusual DST offset was found nearby.  Assume one-hour DST.  */
+-      t += 60 * 60 * dst_difference;
+-      if (mktime_min <= t && t <= mktime_max && convert_time (convert, t, &tm))
+-	goto offset_found;
+-
+       __set_errno (EOVERFLOW);
+       return -1;
+     }
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 744f9652378f6..b924f3f51d345 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -60,7 +60,9 @@ stdenv.mkDerivation rec {
       # only an issue with the useLLVM stdenv, not the darwin stdenv…
       # https://github.com/grpc/grpc/issues/26473#issuecomment-860885484
       useLLVMAndOldCC = (stdenv.hostPlatform.useLLVM or false) && lib.versionOlder stdenv.cc.cc.version "11.0";
-      cxxStandard = if useLLVMAndOldCC then "11" else "17";
+      # With GCC 9 (current aarch64-linux) it fails with c++17 but OK with c++14.
+      useOldGCC = !(stdenv.hostPlatform.useLLVM or false) && lib.versionOlder stdenv.cc.cc.version "10";
+      cxxStandard = if useLLVMAndOldCC then "11" else if useOldGCC then "14" else "17";
     in
     [
       "-DgRPC_ZLIB_PROVIDER=package"
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index c06aa94699371..282486dc88d5c 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -2,6 +2,7 @@
 , stdenv
 , substituteAll
 , fetchurl
+, fetchpatch2
 , pkg-config
 , gettext
 , docbook-xsl-nons
@@ -60,7 +61,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk+3";
-  version = "3.24.34";
+  version = "3.24.35";
 
   outputs = [ "out" "dev" ] ++ lib.optional withGtkDoc "devdoc";
   outputBin = "dev";
@@ -72,12 +73,22 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "sha256-28afkN3IIbjRRB8AN03B2kMjour6kHjmHtvl7u+oUuw=";
+    sha256 = "sha256-7BD+bXEu8LPGO1+TJjnJ0a6Z/OlPUA9vBpZWKf72C9E=";
   };
 
   patches = [
     ./patches/3.0-immodules.cache.patch
     ./patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
+
+    # Add accidentally non-dist’d build file.
+    # https://gitlab.gnome.org/GNOME/gtk/-/commit/b2ad8d2abafbd94c7e58e5e1b98c92e6b6fa6d9a
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/66a199806ceb3daa5e2c7d3a5b45a86007cec46a.patch";
+      includes = [
+        "gdk/wayland/cursor/meson.build"
+      ];
+      sha256 = "cOOcSB3yphff2+7l7YpFbGSswWjV8lJ2tk+Vjgl1ras=";
+    })
   ] ++ lib.optionals stdenv.isDarwin [
     # X11 module requires <gio/gdesktopappinfo.h> which is not installed on Darwin
     # let’s drop that dependency in similar way to how other parts of the library do it
diff --git a/pkgs/development/libraries/libhwy/default.nix b/pkgs/development/libraries/libhwy/default.nix
index 43b2e93d8270a..66f273ba3f289 100644
--- a/pkgs/development/libraries/libhwy/default.nix
+++ b/pkgs/development/libraries/libhwy/default.nix
@@ -1,33 +1,23 @@
-{ lib, stdenv, cmake, ninja, gtest, fetchpatch, fetchFromGitHub }:
+{ lib, stdenv, cmake, ninja, gtest, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "libhwy";
-  version = "0.15.0";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "highway";
     rev = version;
-    sha256 = "sha256-v2HyyHtBydr7QiI83DW1yRv2kWjUOGxFT6mmdrN9XPo=";
+    hash = "sha256-CHzDLzOnu/QfejWiRKE9I5UUyRxoEooNtYVe8FQwu7c=";
   };
 
-  patches = [
-    # Remove on next release
-    # https://github.com/google/highway/issues/460
-    (fetchpatch {
-      name = "hwy-add-missing-includes.patch";
-      url = "https://github.com/google/highway/commit/8ccab40c2f931aca6004d175eec342cc60f6baec.patch";
-      sha256 = "sha256-wlp5gIvK2+OlKtsZwxq/pXTbESkUtimHXaYDjcBzmQ0=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake ninja ];
 
   # Required for case-insensitive filesystems ("BUILD" exists)
   dontUseCmakeBuildDir = true;
 
   cmakeFlags = let
-    libExt = stdenv.hostPlatform.extensions.library;
+    libExt = stdenv.hostPlatform.extensions.sharedLibrary;
   in [
     "-GNinja"
     "-DCMAKE_INSTALL_LIBDIR=lib"
@@ -37,6 +27,8 @@ stdenv.mkDerivation rec {
     "-DGTEST_INCLUDE_DIR=${lib.getDev gtest}/include"
     "-DGTEST_LIBRARY=${lib.getLib gtest}/lib/libgtest${libExt}"
     "-DGTEST_MAIN_LIBRARY=${lib.getLib gtest}/lib/libgtest_main${libExt}"
+  ] ++ lib.optionals stdenv.hostPlatform.isAarch32 [
+    "-DHWY_CMAKE_ARM7=ON"
   ];
 
   # hydra's darwin machines run into https://github.com/libjxl/libjxl/issues/408
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 567d985fd3d45..1c03973fff96b 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libjxl";
-  version = "0.6.1";
+  version = "0.7.0";
 
   outputs = [ "out" "dev" ];
 
@@ -29,47 +29,11 @@ stdenv.mkDerivation rec {
     owner = "libjxl";
     repo = "libjxl";
     rev = "v${version}";
-    sha256 = "sha256-fTK5hyU9PZ6nigMsfzVugwviihgAXfEcLF+l+n5h+54=";
+    sha256 = "sha256-9DBLQ/gMyy2ZUm7PCWYJ7XOzkgQM0cAewJZzMNo8UPs=";
     # There are various submodules in `third_party/`.
     fetchSubmodules = true;
   };
 
-  patches = [
-    # present in master, see https://github.com/libjxl/libjxl/pull/1403
-    (fetchpatch {
-      name = "prefixless-pkg-config.patch";
-      url = "https://github.com/libjxl/libjxl/commit/0b906564bfbfd8507d61c5d6a447f545f893227c.patch";
-      sha256 = "1g5c6lrsmgxb9j64pjy8lbdgbvw834m5jyfivy9ppmd8iiv0kkq4";
-    })
-
-    # present in master, remove after 0.7?
-    (fetchpatch {
-      name = "fix-link-lld-macho.patch";
-      url = "https://github.com/libjxl/libjxl/commit/88fe3fff3dc70c72405f57c69feffd9823930034.patch";
-      sha256 = "1419fyiq4srpj72cynwyvqy8ldi7vn9asvkp5fsbmiqkyhb15jpk";
-    })
-
-    # "robust statistics" have been removed in upstream mainline as they are
-    # conidered to cause "interoperability problems". sure enough the tests
-    # fail with precision issues on aarch64.
-    (fetchpatch {
-      name = "remove-robust-and-descriptive-statistics.patch";
-      url = "https://github.com/libjxl/libjxl/commit/204f87a5e4d684544b13900109abf040dc0b402b.patch";
-      sha256 = "sha256-DoAaYWLmQ+R9GZbHMTYGe0gBL9ZesgtB+2WhmbARna8=";
-    })
-
-    # fix build with asciidoc wrapped in shell script
-    (fetchpatch {
-      url = "https://github.com/libjxl/libjxl/commit/b8ec58c58c6281987f42ebec892f513824c0cc0e.patch";
-      hash = "sha256-g8U+YVhLfgSHJ+PWJgvVOI66+FElJSC8IgSRodNnsMw=";
-    })
-    (fetchpatch {
-      url = "https://github.com/libjxl/libjxl/commit/ca8e276aacf63a752346a6a44ba673b0af993237.patch";
-      excludes = [ "AUTHORS" ];
-      hash = "sha256-9VXy1LdJ0JhYbCGPNMySpnGLBxUrr8BYzE+oU3LnUGw=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     gtest
@@ -136,12 +100,17 @@ stdenv.mkDerivation rec {
     # * the `gimp` one, which allows GIMP to load jpeg-xl files
     # "-DJPEGXL_ENABLE_PLUGINS=ON"
   ] ++ lib.optionals stdenv.hostPlatform.isStatic [
-   "-DJPEGXL_STATIC=ON"
+    "-DJPEGXL_STATIC=ON"
+  ] ++ lib.optionals stdenv.hostPlatform.isAarch32 [
+    "-DJPEGXL_FORCE_NEON=ON"
   ];
 
   LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
+  CXXFLAGS = lib.optionalString stdenv.hostPlatform.isAarch32 "-mfp16-format=ieee";
 
-  doCheck = !stdenv.hostPlatform.isi686;
+  # FIXME x86_64-darwin:
+  # https://github.com/NixOS/nixpkgs/pull/204030#issuecomment-1352768690
+  doCheck = with stdenv; !(hostPlatform.isi686 || isDarwin && isx86_64);
 
   meta = with lib; {
     homepage = "https://github.com/libjxl/libjxl";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index bcc34905a23f0..78230898d7fc5 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -8,7 +8,7 @@
 , vulkan-loader, glslang
 , galliumDrivers ? ["auto"]
 # upstream Mesa defaults to only enabling swrast (aka lavapipe) on aarch64 for some reason, so force building the others
-, vulkanDrivers ? [ "auto" ] ++ lib.optionals (stdenv.isLinux && stdenv.isAarch64) [ "broadcom" "freedreno" "panfrost" ]
+, vulkanDrivers ? if (stdenv.isLinux && stdenv.isAarch64) then [ "swrast" "broadcom" "freedreno" "panfrost" ] else [ "auto" ]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
 , vulkanLayers ? lib.optionals (!stdenv.isDarwin) [ "device-select" "overlay" ] # No Vulkan support on Darwin
 , OpenGL, Xplugin
@@ -37,7 +37,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.2.4";
+  version = "22.2.5";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -52,7 +52,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "sha256-ZddrU8pce0YBng6OW0FN5F0v7NP81xcH9sO8dpHJ96s=";
+    sha256 = "sha256-hQ8GMUb467JirsBPZmwsHlYj8qGYfdok5DYbF7kSxzs=";
   };
 
   # TODO:
diff --git a/pkgs/development/libraries/mpfr/default.nix b/pkgs/development/libraries/mpfr/default.nix
index 76d2c9e0ece99..7d9e94c6f909e 100644
--- a/pkgs/development/libraries/mpfr/default.nix
+++ b/pkgs/development/libraries/mpfr/default.nix
@@ -22,6 +22,13 @@ stdenv.mkDerivation rec {
     hash = "sha256-/9GVvVZ9uv/DuYsj/QCq0FN2gMmJYXHkT+P/eeKKwz0=";
   };
 
+  patches = [
+    (fetchurl { # https://gitlab.inria.fr/mpfr/mpfr/-/issues/1
+      url = "https://www.mpfr.org/mpfr-4.1.1/patch01";
+      hash = "sha256-gKPCcJviGsqsEqnMmYiNY6APp3+3VXbyBf6LoZhP9Eo=";
+    })
+  ];
+
   outputs = [ "out" "dev" "doc" "info" ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/nss/latest.nix b/pkgs/development/libraries/nss/latest.nix
index 56d6c0e471030..72c86bf41a817 100644
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@@ -5,6 +5,6 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
 
 import ./generic.nix {
-  version = "3.85";
-  hash = "sha256-r9nWRRCxFU3rvWyrNXHp/2SjNziY4DSD5Mhc2toT0pc=";
+  version = "3.86";
+  hash = "sha256-PzhfxoZHa7uoEQNfpoIbVCR11VdHsYwgwiHU1mVzuXU=";
 }
diff --git a/pkgs/development/libraries/opencl-clang/default.nix b/pkgs/development/libraries/opencl-clang/default.nix
index f4897331c938d..58307198f7272 100644
--- a/pkgs/development/libraries/opencl-clang/default.nix
+++ b/pkgs/development/libraries/opencl-clang/default.nix
@@ -4,10 +4,8 @@
 , fetchpatch
 , cmake
 , git
-
 , llvmPackages_11
 , spirv-llvm-translator
-
 , buildWithPatches ? true
 }:
 
@@ -16,32 +14,25 @@ let
     inherit spirv-llvm-translator;
   };
 
-  inherit (lib) getVersion;
-
-  addPatches = component: pkg:
-    with builtins; with lib;
-    let path = "${passthru.patchesOut}/${component}";
-    in pkg.overrideAttrs (super: {
-      postPatch = (if super ? postPatch then super.postPatch + "\n" else "") + ''
-        for p in ${path}/*
-        do
-          patch -p1 -i "$p"
-        done
-      '';
-    });
+  addPatches = component: pkg: pkg.overrideAttrs (oldAttrs: {
+    postPatch = oldAttrs.postPatch or "" + ''
+      for p in ${passthru.patchesOut}/${component}/*; do
+        patch -p1 -i "$p"
+      done
+    '';
+  });
 
   passthru = rec {
-    spirv-llvm-translator = llvmPkgs.spirv-llvm-translator;
+    spirv-llvm-translator = llvmPkgs.spirv-llvm-translator.override { llvm = llvmPackages_11.llvm; };
     llvm = addPatches "llvm" llvmPkgs.llvm;
     libclang = addPatches "clang" llvmPkgs.libclang;
 
     clang-unwrapped = libclang.out;
-
     clang = llvmPkgs.clang.override {
       cc = clang-unwrapped;
     };
 
-    patchesOut = stdenv.mkDerivation rec {
+    patchesOut = stdenv.mkDerivation {
       pname = "opencl-clang-patches";
       inherit (library) version src patches;
       # Clang patches assume the root is the llvm root dir
@@ -62,14 +53,13 @@ let
   };
 
   library = let
-    inherit (llvmPkgs) llvm;
+    inherit (llvmPackages_11) llvm;
     inherit (if buildWithPatches then passthru else llvmPkgs) libclang spirv-llvm-translator;
   in
-    stdenv.mkDerivation rec {
+    stdenv.mkDerivation {
       pname = "opencl-clang";
       version = "unstable-2022-03-16";
 
-      inherit passthru;
 
       src = fetchFromGitHub {
         owner = "intel";
@@ -79,8 +69,8 @@ let
       };
 
       patches = [
-      # Build script tries to find Clang OpenCL headers under ${llvm}
-      # Work around it by specifying that directory manually.
+        # Build script tries to find Clang OpenCL headers under ${llvm}
+        # Work around it by specifying that directory manually.
         ./opencl-headers-dir.patch
       ];
 
@@ -96,19 +86,21 @@ let
       buildInputs = [ libclang llvm spirv-llvm-translator ];
 
       cmakeFlags = [
-        "-DPREFERRED_LLVM_VERSION=${getVersion llvm}"
-        "-DOPENCL_HEADERS_DIR=${libclang.lib}/lib/clang/${getVersion libclang}/include/"
+        "-DPREFERRED_LLVM_VERSION=${lib.getVersion llvm}"
+        "-DOPENCL_HEADERS_DIR=${libclang.lib}/lib/clang/${lib.getVersion libclang}/include/"
 
         "-DLLVMSPIRV_INCLUDED_IN_LLVM=OFF"
         "-DSPIRV_TRANSLATOR_DIR=${spirv-llvm-translator}"
       ];
 
+      inherit passthru;
+
       meta = with lib; {
         homepage    = "https://github.com/intel/opencl-clang/";
         description = "A clang wrapper library with an OpenCL-oriented API and the ability to compile OpenCL C kernels to SPIR-V modules";
         license     = licenses.ncsa;
         platforms   = platforms.all;
-        maintainers = with maintainers; [ gloaming ];
+        maintainers = with maintainers; [ SuperSandro2000 ];
       };
     };
 in
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index 3beeaa67321e0..e6d9a6d7b89dc 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pango";
-  version = "1.50.11";
+  version = "1.50.12";
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "iAD4Etie5hOIGIcDID86eHiWPCL4aVqvH6ChoUKNF64=";
+    sha256 = "yu+W0nu+eSpr6ScnxzRo2DKxPaV8gHHvebnfae4Fj+M=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index f93db9284c1dc..8f0852b06a12a 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -24,7 +24,7 @@
 , vulkan-loader
 , webrtc-audio-processing
 , ncurses
-, readline81 # meson can't find <7 as those versions don't have a .pc file
+, readline # meson can't find <7 as those versions don't have a .pc file
 , lilv
 , makeFontsConf
 , callPackage
@@ -68,7 +68,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.60";
+    version = "0.3.63";
 
     outputs = [
       "out"
@@ -86,7 +86,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-HDE2QAV2jnEJCqgiGx4TVP4ceeKAqwd4P3OYw6auNAM=";
+      sha256 = "sha256-GQJpw5G9YN7T2upu2FLUxE8UvMRev3K2j4Z1uK1/dt4=";
     };
 
     patches = [
@@ -102,26 +102,6 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
-
-      # Following are backported patches as recommended by upstream.
-      # FIXME: remove in 0.3.61
-      # fix tdesktop with pw-pulse
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/b720da771efa950cf380101bed42d5d5ee177908.diff";
-        hash = "sha256-p/BvatnbEJAMLQUUOECKAK7FppaNp9ei3FHjAw2spM8=";
-      })
-
-      # fix a crash when quickly switching Bluetooth profiles
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/bf3516ba0496b644b3944b114253f23964178897.diff";
-        hash = "sha256-LqasplS/azCPekslJQPTd9MZkUcRqA0ks94FtwyY3GA=";
-      })
-
-      # fix no sound in VMs (Pipewire on the guest)
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/b46d8a8c921a8da6883610ad4b68da95bf59b59e.diff";
-        hash = "sha256-2VHBwXbzUAGP/fG4xxoFLHSb9oXQK1BPuNv3zAV8cEg=";
-      })
     ];
 
     nativeBuildInputs = [
@@ -143,7 +123,7 @@ let
       libsndfile
       lilv
       ncurses
-      readline81
+      readline
       udev
       vulkan-headers
       vulkan-loader
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 645a13272545c..e9f9120620ac4 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -37,7 +37,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "polkit";
-  version = "121";
+  version = "122";
 
   outputs = [ "bin" "dev" "out" ]; # small man pages in $bin
 
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     owner = "polkit";
     repo = "polkit";
     rev = version;
-    sha256 = "Lj7KSGILc6CBsNqPO0G0PNt6ClikbRG45E8FZbb46yY=";
+    sha256 = "fLY8i8h4McAnwVt8dLOqbyHM7v3SkbWqATz69NkUudU=";
   };
 
   patches = [
@@ -57,14 +57,6 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/7ba07551dfcd4ef9a87b8f0d9eb8b91fabcb41b3.patch";
       sha256 = "ebbLILncq1hAZTBMsLm+vDGw6j0iQ0crGyhzyLZQgKA=";
     })
-    # Make netgroup support optional (musl does not have it)
-    # Upstream MR: https://gitlab.freedesktop.org/polkit/polkit/merge_requests/10
-    # NOTE: Remove after the next release
-    (fetchpatch {
-      name = "make-innetgr-optional.patch";
-      url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/b57deee8178190a7ecc75290fa13cf7daabc2c66.patch";
-      sha256 = "8te6gatT9Fp+fIT05fQBym5mEwHeHfaUNUNEMfSbtLc=";
-    })
   ];
 
   depsBuildBuild = [
@@ -119,7 +111,7 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "--datadir=${system}/share"
     "--sysconfdir=/etc"
-    "-Dsystemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
+    "-Dsystemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
     "-Dpolkitd_user=polkituser" #TODO? <nixos> config.ids.uids.polkituser
     "-Dos_type=redhat" # only affects PAM includes
     "-Dtests=${lib.boolToString doCheck}"
diff --git a/pkgs/development/libraries/qrencode/default.nix b/pkgs/development/libraries/qrencode/default.nix
index 57ccfd382f7b7..b8f01bcff5a13 100644
--- a/pkgs/development/libraries/qrencode/default.nix
+++ b/pkgs/development/libraries/qrencode/default.nix
@@ -12,12 +12,16 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ SDL2 libpng ] ++ lib.optionals stdenv.isDarwin [ libiconv libobjc ];
+
+  buildInputs = [ libpng ]
+    ++ lib.optionals stdenv.isDarwin [ libiconv libobjc ];
 
   configureFlags = [
     "--with-tests"
   ];
 
+  checkInputs = [ SDL2 ];
+
   doCheck = true;
 
   checkPhase = ''
@@ -33,13 +37,11 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://fukuchi.org/works/qrencode/";
     description = "C library for encoding data in a QR Code symbol";
-
     longDescription = ''
       Libqrencode is a C library for encoding data in a QR Code symbol,
       a kind of 2D symbology that can be scanned by handy terminals
       such as a mobile phone with CCD.
     '';
-
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ adolfogc yana ];
     platforms = platforms.all;
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index 857da102bb8c0..dafc91e6dcfa6 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re2";
-  version = "2022-06-01";
+  version = "2022-12-01";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
     rev = version;
-    hash = "sha256-UontAjOXpnPcOgoFHjf+1WSbCR7h58/U7nn4meT200Y=";
+    hash = "sha256-RmPXfavSKVnnl/RJ5aTjc/GbkPz+EXiFg1n5e4s6wjw=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index b432739beccc6..e5ea8b17f6aaf 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , gettext
 , meson
 , ninja
@@ -30,23 +29,15 @@
 
 stdenv.mkDerivation rec {
   pname = "tracker";
-  version = "3.4.1";
+  version = "3.4.2";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "6p1BqfucK0KtgPwsgjJ7XHE9WUyWmwnhpJvmP7dPT64=";
+    sha256 = "Tm3xQqT3BIePypjrtaIkdQ5epUaqKqq6pyanNUC9FzE=";
   };
 
-  patches = [
-    # Backport compatibility fix for newer SQLite.
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/tracker/-/merge_requests/552.patch";
-      sha256 = "1pmhhj47dbn654vb6a0kh5h6hw71lvaqxr141r60zrv5zx7m3sh9";
-    })
-  ];
-
   postPatch = ''
     patchShebangs utils/data-generators/cc/generate
   '';
diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index d9257b7dec6f4..1d4b62788935b 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wayland-protocols";
-  version = "1.30";
+  version = "1.31";
 
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/${pname}/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
-    hash = "sha256-PBSY+2X9K4CwN21+h88hXmrpV7LM26XaRaRIcYgxvGA=";
+    hash = "sha256-oH+nIu2HZ27AINhncUvJovJMRk2nORLzlwbu71IZ4jg=";
   };
 
   postPatch = lib.optionalString doCheck ''
diff --git a/pkgs/development/libraries/x265/default.nix b/pkgs/development/libraries/x265/default.nix
index b4a7777b8911b..92f7f11170f6e 100644
--- a/pkgs/development/libraries/x265/default.nix
+++ b/pkgs/development/libraries/x265/default.nix
@@ -34,6 +34,8 @@ let
     (mkFlag ppaSupport "ENABLE_PPA")
     (mkFlag vtuneSupport "ENABLE_VTUNE")
     (mkFlag werrorSupport "WARNINGS_AS_ERRORS")
+    # Potentially riscv cross could be fixed by providing the correct CMAKE_SYSTEM_PROCESSOR flag
+    (mkFlag (with stdenv; !(isCross && hostPlatform.isRiscV || isDarwin && isAarch64)) "ENABLE_ASSEMBLY")
   ];
 
   cmakeStaticLibFlags = [
diff --git a/pkgs/development/ocaml-modules/apron/default.nix b/pkgs/development/ocaml-modules/apron/default.nix
index bfef3d5b6c66e..c74545caf24fe 100644
--- a/pkgs/development/ocaml-modules/apron/default.nix
+++ b/pkgs/development/ocaml-modules/apron/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, lib, fetchFromGitHub, perl, gmp, mpfr, ppl, ocaml, findlib, camlidl, mlgmpidl }:
+{ stdenv, lib, fetchFromGitHub, perl, gmp, mpfr, ppl, ocaml, findlib, camlidl, mlgmpidl
+, gnumake42
+}:
 
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-apron";
@@ -10,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "14ymjahqdxj26da8wik9d5dzlxn81b3z1iggdl7rn2nn06jy7lvy";
   };
 
-  nativeBuildInputs = [ ocaml findlib perl ];
+  # fails with make 4.4
+  nativeBuildInputs = [ ocaml findlib perl gnumake42 ];
   buildInputs = [ gmp mpfr ppl camlidl ];
   propagatedBuildInputs = [ mlgmpidl ];
 
diff --git a/pkgs/development/ocaml-modules/lablgtk/default.nix b/pkgs/development/ocaml-modules/lablgtk/default.nix
index 9a4bf801d1e55..96dbd071fdefe 100644
--- a/pkgs/development/ocaml-modules/lablgtk/default.nix
+++ b/pkgs/development/ocaml-modules/lablgtk/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, ocaml, findlib, pkg-config, gtk2, libgnomecanvas, gtksourceview
-, camlp-streams
+, camlp-streams, gnumake42
 }:
 
 let param =
@@ -32,7 +32,8 @@ stdenv.mkDerivation {
   pname = "ocaml${ocaml.version}-lablgtk";
   inherit (param) version src NIX_CFLAGS_COMPILE;
 
-  nativeBuildInputs = [ pkg-config ocaml findlib ];
+  # gnumake42: https://github.com/garrigue/lablgtk/issues/162
+  nativeBuildInputs = [ pkg-config ocaml findlib gnumake42 ];
   buildInputs = [ gtk2 libgnomecanvas gtksourceview ]
   ++ param.buildInputs or [];
 
diff --git a/pkgs/development/python-modules/aiocontextvars/default.nix b/pkgs/development/python-modules/aiocontextvars/default.nix
index dc70baab9e5ca..f673e86bbacc8 100644
--- a/pkgs/development/python-modules/aiocontextvars/default.nix
+++ b/pkgs/development/python-modules/aiocontextvars/default.nix
@@ -2,17 +2,16 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-runner
-, pytest
+, pytestCheckHook
 , pytest-asyncio
-, contextvars
 , sqlalchemy
 , isPy27
-, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "aiocontextvars";
   version = "0.2.2";
+  format = "setuptools";
   disabled = isPy27;
 
   src = fetchFromGitHub {
@@ -26,18 +25,14 @@ buildPythonPackage rec {
     pytest-runner
   ];
 
-  checkInputs = [
-    pytest
-    pytest-asyncio
-  ];
-
   propagatedBuildInputs = [
     sqlalchemy
-  ] ++ lib.optionals (pythonOlder "3.7") [ contextvars ];
+  ];
 
-  checkPhase = ''
-    pytest
-  '';
+  checkInputs = [
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
   meta = with lib; {
     description = "Asyncio support for PEP-567 contextvars backport";
diff --git a/pkgs/development/python-modules/apache-airflow/default.nix b/pkgs/development/python-modules/apache-airflow/default.nix
index 463890c61ebcd..cbedbeb70dcab 100644
--- a/pkgs/development/python-modules/apache-airflow/default.nix
+++ b/pkgs/development/python-modules/apache-airflow/default.nix
@@ -16,7 +16,6 @@
 , cron-descriptor
 , croniter
 , cryptography
-, dataclasses
 , deprecated
 , dill
 , flask
@@ -137,7 +136,7 @@ buildPythonPackage rec {
   inherit version;
   src = airflow-src;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   propagatedBuildInputs = [
     alembic
@@ -203,8 +202,6 @@ buildPythonPackage rec {
     typing-extensions
     unicodecsv
     werkzeug
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ] ++ lib.optionals (pythonOlder "3.9") [
     importlib-metadata
   ] ++ providerDependencies;
diff --git a/pkgs/development/python-modules/azure-core/default.nix b/pkgs/development/python-modules/azure-core/default.nix
index 75cf395876153..4e9329f22603a 100644
--- a/pkgs/development/python-modules/azure-core/default.nix
+++ b/pkgs/development/python-modules/azure-core/default.nix
@@ -21,6 +21,8 @@ buildPythonPackage rec {
   pname = "azure-core";
   disabled = pythonOlder "3.6";
 
+  __darwinAllowLocalNetworking = true;
+
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
diff --git a/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix b/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix
index 7db161b86110a..40014adb9088e 100644
--- a/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix
+++ b/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix
@@ -1,21 +1,34 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytz
+, unittestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "backports-datetime-fromisoformat";
-  version = "1.0.0";
+  version = "2.0.0";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0p0gyhfqq6gssf3prsy0pcfq5w0wx2w3pcjqbwx3imvc92ls4xwm";
+  src = fetchFromGitHub {
+    owner = "movermeyer";
+    repo = "backports.datetime_fromisoformat";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-aHF3E/fLN+j/T4W9lvuVSMy6iRSEn+ARWmL01rY+ixs=";
   };
 
-  # no tests in pypi package
-  doCheck = false;
+  checkInputs = [
+    pytz
+    unittestCheckHook
+  ];
 
-  pythonImportsCheck = [ "backports.datetime_fromisoformat" ];
+  pythonImportsCheck = [
+    "backports.datetime_fromisoformat"
+  ];
 
   meta = with lib; {
-    description = "Backport of Python 3.7's datetime.fromisoformat";
+    changelog = "https://github.com/movermeyer/backports.datetime_fromisoformat/releases/tag/v${version}";
+    description = "Backport of Python 3.11's datetime.fromisoformat";
     homepage = "https://github.com/movermeyer/backports.datetime_fromisoformat";
     license = licenses.mit;
     maintainers = with maintainers; [ SuperSandro2000 ];
diff --git a/pkgs/development/python-modules/backports-entry-points-selectable/default.nix b/pkgs/development/python-modules/backports-entry-points-selectable/default.nix
index 84618e8da1d81..9ff04e0e50380 100644
--- a/pkgs/development/python-modules/backports-entry-points-selectable/default.nix
+++ b/pkgs/development/python-modules/backports-entry-points-selectable/default.nix
@@ -1,16 +1,27 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, setuptools-scm, importlib-metadata }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, setuptools-scm
+, importlib-metadata
+}:
 
 buildPythonPackage rec {
   pname = "backports-entry-points-selectable";
-  version = "1.1.1";
+  version = "1.2.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "backports.entry_points_selectable";
     inherit version;
-    sha256 = "914b21a479fde881635f7af5adc7f6e38d6b274be32269070c53b698c60d5386";
+    hash = "sha256-Rwb1kXllfKfB0yWlQ+4TcPj0YzH0MrysYvqyQv3wr6U=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
     importlib-metadata
@@ -24,6 +35,7 @@ buildPythonPackage rec {
   pythonNamespaces = [ "backports" ];
 
   meta = with lib; {
+    changelog = "https://github.com/jaraco/backports.entry_points_selectable/blob/v${version}/CHANGES.rst";
     description = "Compatibility shim providing selectable entry points for older implementations";
     homepage = "https://github.com/jaraco/backports.entry_points_selectable";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/backports_abc/default.nix b/pkgs/development/python-modules/backports_abc/default.nix
deleted file mode 100644
index 684626c0780f2..0000000000000
--- a/pkgs/development/python-modules/backports_abc/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, unittestCheckHook
-}:
-
-buildPythonPackage rec {
-  pname = "backports_abc";
-  version = "0.5";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "033be54514a03e255df75c5aee8f9e672f663f93abb723444caec8fe43437bde";
-  };
-
-  checkInputs = [ unittestCheckHook ];
-
-  meta = {
-    homepage = "https://github.com/cython/backports_abc";
-    license = lib.licenses.psfl;
-    description = "A backport of recent additions to the 'collections.abc' module";
-  };
-}
diff --git a/pkgs/development/python-modules/backports_ssl_match_hostname/default.nix b/pkgs/development/python-modules/backports_ssl_match_hostname/default.nix
deleted file mode 100644
index a7403e16123ab..0000000000000
--- a/pkgs/development/python-modules/backports_ssl_match_hostname/default.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi, pythonAtLeast }:
-
-buildPythonPackage rec {
-  pname = "backports.ssl_match_hostname";
-  version = "3.7.0.1";
-  disabled = pythonAtLeast "3.7";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "bb82e60f9fbf4c080eabd957c39f0641f0fc247d9a16e31e26d594d8f42b9fd2";
-  };
-
-  meta = with lib; {
-    description = "The Secure Sockets layer is only actually *secure*";
-    homepage = "https://bitbucket.org/brandon/backports.ssl_match_hostname";
-    license = licenses.psfl;
-  };
-}
diff --git a/pkgs/development/python-modules/betterproto/default.nix b/pkgs/development/python-modules/betterproto/default.nix
index b49204ee8c440..e8b49dd839ae5 100644
--- a/pkgs/development/python-modules/betterproto/default.nix
+++ b/pkgs/development/python-modules/betterproto/default.nix
@@ -5,7 +5,6 @@
 , poetry-core
 , grpclib
 , python-dateutil
-, dataclasses
 , black
 , jinja2
 , isort
@@ -21,7 +20,7 @@ buildPythonPackage rec {
   pname = "betterproto";
   version = "2.0.0b5";
   format = "pyproject";
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "danielgtaylor";
@@ -35,8 +34,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     grpclib
     python-dateutil
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ];
 
   passthru.optional-dependencies.compiler = [
diff --git a/pkgs/development/python-modules/bpython/default.nix b/pkgs/development/python-modules/bpython/default.nix
index f919d5cabe29a..56c30df15eec4 100644
--- a/pkgs/development/python-modules/bpython/default.nix
+++ b/pkgs/development/python-modules/bpython/default.nix
@@ -3,7 +3,6 @@
 , fetchPypi
 , curtsies
 , cwcwidth
-, dataclasses
 , greenlet
 , jedi
 , pygments
@@ -23,7 +22,7 @@ buildPythonPackage rec {
   version = "0.23";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -42,8 +41,6 @@ buildPythonPackage rec {
     typing-extensions
     urwid
     watchdog
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ];
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/cchardet/default.nix b/pkgs/development/python-modules/cchardet/default.nix
index 587d0d1f6c126..1ec1ee57c1a78 100644
--- a/pkgs/development/python-modules/cchardet/default.nix
+++ b/pkgs/development/python-modules/cchardet/default.nix
@@ -2,19 +2,24 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, python
+, cython
 , nose
 }:
 
 buildPythonPackage rec {
   pname = "cchardet";
   version = "2.1.7";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "c428b6336545053c2589f6caf24ea32276c6664cb86db817e03a94c60afa0eaf";
   };
 
+  nativeBuildInputs = [
+    cython # pending https://github.com/PyYoshi/cChardet/pull/78 being released to PyPI
+  ];
+
   pythonImportsCheck = [
     "cchardet"
   ];
diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index ecf7ed49aa5c4..c80ba08503d41 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, cacert
 , pythonOlder
 , fetchFromGitHub
 , pytestCheckHook
@@ -7,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2022.09.24";
+  version = "2022.12.07";
 
   disabled = pythonOlder "3.6";
 
@@ -15,9 +16,25 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-certifi";
     rev = version;
-    hash = "sha256-B6LO6AfG9cfpyNI7hj3VjmGTFsrrIkDYO4gPMkZY74w=";
+    hash = "sha256-r6TJ6YGL0cygz+F6g6wiqBfBa/QKhynZ92C6lHTZ2rI=";
   };
 
+  patches = [
+    # Add support for NIX_SSL_CERT_FILE
+    ./env.patch
+  ];
+
+  postPatch = ''
+    # Use our system-wide ca-bundle instead of the bundled one
+    rm -v "certifi/cacert.pem"
+    ln -snvf "${cacert}/etc/ssl/certs/ca-bundle.crt" "certifi/cacert.pem"
+  '';
+
+  propagatedNativeBuildInputs = [
+    # propagate cacerts setup-hook to set up `NIX_SSL_CERT_FILE`
+    cacert
+  ];
+
   checkInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/certifi/env.patch b/pkgs/development/python-modules/certifi/env.patch
new file mode 100644
index 0000000000000..292f977ef2c07
--- /dev/null
+++ b/pkgs/development/python-modules/certifi/env.patch
@@ -0,0 +1,86 @@
+diff --git a/certifi/core.py b/certifi/core.py
+index de02898..c033d20 100644
+--- a/certifi/core.py
++++ b/certifi/core.py
+@@ -4,15 +4,25 @@ certifi.py
+ 
+ This module returns the installation location of cacert.pem or its contents.
+ """
++import os
+ import sys
+ 
+ 
++def get_cacert_path_from_environ():
++    path = os.environ.get("NIX_SSL_CERT_FILE", None)
++
++    if path == "/no-cert-file.crt":
++        return None
++
++    return path
++
++
+ if sys.version_info >= (3, 11):
+ 
+     from importlib.resources import as_file, files
+ 
+     _CACERT_CTX = None
+-    _CACERT_PATH = None
++    _CACERT_PATH = get_cacert_path_from_environ()
+ 
+     def where() -> str:
+         # This is slightly terrible, but we want to delay extracting the file
+@@ -39,14 +49,16 @@ if sys.version_info >= (3, 11):
+         return _CACERT_PATH
+ 
+     def contents() -> str:
+-        return files("certifi").joinpath("cacert.pem").read_text(encoding="ascii")
++        if _CACERT_PATH is not None:
++            return open(_CACERT_PATH, encoding="utf-8").read()
++        return files("certifi").joinpath("cacert.pem").read_text(encoding="utf-8")
+ 
+ elif sys.version_info >= (3, 7):
+ 
+     from importlib.resources import path as get_path, read_text
+ 
+     _CACERT_CTX = None
+-    _CACERT_PATH = None
++    _CACERT_PATH = get_cacert_path_from_environ()
+ 
+     def where() -> str:
+         # This is slightly terrible, but we want to delay extracting the
+@@ -74,7 +86,9 @@ elif sys.version_info >= (3, 7):
+         return _CACERT_PATH
+ 
+     def contents() -> str:
+-        return read_text("certifi", "cacert.pem", encoding="ascii")
++        if _CACERT_PATH is not None:
++            return open(_CACERT_PATH, encoding="utf-8").read()
++        return read_text("certifi", "cacert.pem", encoding="utf-8")
+ 
+ else:
+     import os
+@@ -84,6 +98,8 @@ else:
+     Package = Union[types.ModuleType, str]
+     Resource = Union[str, "os.PathLike"]
+ 
++    _CACERT_PATH = get_cacert_path_from_environ()
++
+     # This fallback will work for Python versions prior to 3.7 that lack the
+     # importlib.resources module but relies on the existing `where` function
+     # so won't address issues with environments like PyOxidizer that don't set
+@@ -102,7 +118,14 @@ else:
+     def where() -> str:
+         f = os.path.dirname(__file__)
+ 
++        if _CACERT_PATH is not None:
++            return _CACERT_PATH
++
+         return os.path.join(f, "cacert.pem")
+ 
+     def contents() -> str:
+-        return read_text("certifi", "cacert.pem", encoding="ascii")
++        if _CACERT_PATH is not None:
++            with open(_CACERT_PATH, encoding="utf-8") as data:
++                return data.read()
++
++        return read_text("certifi", "cacert.pem", encoding="utf-8")
diff --git a/pkgs/development/python-modules/cffi/darwin-use-libffi-closures.diff b/pkgs/development/python-modules/cffi/darwin-use-libffi-closures.diff
new file mode 100644
index 0000000000000..c48c8090dd461
--- /dev/null
+++ b/pkgs/development/python-modules/cffi/darwin-use-libffi-closures.diff
@@ -0,0 +1,21 @@
+diff -r bac92fcfe4d7 c/_cffi_backend.c
+--- a/c/_cffi_backend.c	Mon Jul 18 15:58:34 2022 +0200
++++ b/c/_cffi_backend.c	Sat Aug 20 12:38:31 2022 -0700
+@@ -96,7 +96,7 @@
+ # define CFFI_CHECK_FFI_PREP_CIF_VAR 0
+ # define CFFI_CHECK_FFI_PREP_CIF_VAR_MAYBE 0
+ 
+-#elif defined(__APPLE__) && defined(FFI_AVAILABLE_APPLE)
++#elif defined(__APPLE__)
+ 
+ # define CFFI_CHECK_FFI_CLOSURE_ALLOC __builtin_available(macos 10.15, ios 13, watchos 6, tvos 13, *)
+ # define CFFI_CHECK_FFI_CLOSURE_ALLOC_MAYBE 1
+@@ -6413,7 +6413,7 @@
+     else
+ #endif
+     {
+-#if defined(__APPLE__) && defined(FFI_AVAILABLE_APPLE) && !FFI_LEGACY_CLOSURE_API
++#if defined(__APPLE__) && !FFI_LEGACY_CLOSURE_API
+         PyErr_Format(PyExc_SystemError, "ffi_prep_closure_loc() is missing");
+         goto error;
+ #else
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index 52b9ab08fc4dd..fb08761a52846 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -1,5 +1,14 @@
-{ lib, stdenv, buildPythonPackage, isPyPy, fetchPypi, pytestCheckHook,
-  libffi, pkg-config, pycparser, python, fetchpatch
+{ lib
+, stdenv
+, buildPythonPackage
+, isPyPy
+, fetchPypi
+, fetchpatch
+, pytestCheckHook
+, libffi
+, pkg-config
+, pycparser
+, pythonAtLeast
 }:
 
 if isPyPy then null else buildPythonPackage rec {
@@ -11,22 +20,27 @@ if isPyPy then null else buildPythonPackage rec {
     sha256 = "sha256-1AC/uaN7E1ElPLQCZxzqfom97MKU6AFqcH9tHYrJNPk=";
   };
 
-  buildInputs = [ libffi ];
-
-  nativeBuildInputs = [ pkg-config ];
-
-  propagatedBuildInputs = [ pycparser ];
-
-  patches =
+  patches = [
+    #
+    # Trusts the libffi library inside of nixpkgs on Apple devices.
+    #
+    # Based on some analysis I did:
+    #
+    #   https://groups.google.com/g/python-cffi/c/xU0Usa8dvhk
+    #
+    # I believe that libffi already contains the code from Apple's fork that is
+    # deemed safe to trust in cffi.
+    #
+    ./darwin-use-libffi-closures.diff
+  ] ++  lib.optionals (pythonAtLeast "3.11") [
     # Fix test that failed because python seems to have changed the exception format in the
     # final release. This patch should be included in the next version and can be removed when
     # it is released.
-    lib.optionals (python.pythonVersion == "3.11") [
-      (fetchpatch {
-        url = "https://foss.heptapod.net/pypy/cffi/-/commit/8a3c2c816d789639b49d3ae867213393ed7abdff.diff";
-        sha256 = "sha256-3wpZeBqN4D8IP+47QDGK7qh/9Z0Ag4lAe+H0R5xCb1E=";
-      })
-    ];
+    (fetchpatch {
+      url = "https://foss.heptapod.net/pypy/cffi/-/commit/8a3c2c816d789639b49d3ae867213393ed7abdff.diff";
+      sha256 = "sha256-3wpZeBqN4D8IP+47QDGK7qh/9Z0Ag4lAe+H0R5xCb1E=";
+    })
+  ];
 
   postPatch = lib.optionalString stdenv.isDarwin ''
     # Remove setup.py impurities
@@ -36,13 +50,17 @@ if isPyPy then null else buildPythonPackage rec {
       --replace '/usr/include/libffi' '${lib.getDev libffi}/include'
   '';
 
+  buildInputs = [ libffi ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  propagatedBuildInputs = [ pycparser ];
+
   # The tests use -Werror but with python3.6 clang detects some unreachable code.
   NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
     "-Wno-unused-command-line-argument -Wno-unreachable-code -Wno-c++11-narrowing";
 
-  # Lots of tests fail on aarch64-darwin due to "Cannot allocate write+execute memory":
-  # * https://cffi.readthedocs.io/en/latest/using.html#callbacks
-  doCheck = !stdenv.hostPlatform.isMusl && !(stdenv.isDarwin && stdenv.isAarch64);
+  doCheck = !stdenv.hostPlatform.isMusl;
 
   checkInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/ciso8601/default.nix b/pkgs/development/python-modules/ciso8601/default.nix
index 79afe8500072d..0c9a08d33a4f9 100644
--- a/pkgs/development/python-modules/ciso8601/default.nix
+++ b/pkgs/development/python-modules/ciso8601/default.nix
@@ -1,14 +1,15 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
+, pytestCheckHook
 , pytz
-, unittest2
-, isPy27
 }:
 
 buildPythonPackage rec {
   pname = "ciso8601";
   version = "2.2.0";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "closeio";
@@ -17,10 +18,17 @@ buildPythonPackage rec {
     sha256 = "sha256-TqB1tQDgCkXu+QuzP6yBEH/xHxhhD/kGR2S0I8Osc5E=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   checkInputs = [
+    pytestCheckHook
     pytz
-  ] ++ lib.optionals (isPy27) [
-    unittest2
+  ];
+
+  pytestFlagsArray = [
+    "tests/tests.py"
   ];
 
   pythonImportsCheck = [ "ciso8601" ];
diff --git a/pkgs/development/python-modules/clickclick/default.nix b/pkgs/development/python-modules/clickclick/default.nix
index 8aeb73bb25b20..00bf8aba4709c 100644
--- a/pkgs/development/python-modules/clickclick/default.nix
+++ b/pkgs/development/python-modules/clickclick/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, isPy36, flake8, click, pyyaml, six, pytestCheckHook, pytest-cov }:
+{ lib, buildPythonPackage, fetchFromGitHub, flake8, click, pyyaml, six, pytestCheckHook, pytest-cov }:
 
 buildPythonPackage rec {
   pname = "clickclick";
@@ -17,8 +17,6 @@ buildPythonPackage rec {
   # test_cli asserts on exact quoting style of output
   disabledTests = [
     "test_cli"
-  ] ++ lib.optionals isPy36 [
-    "test_choice_default"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/contextvars/default.nix b/pkgs/development/python-modules/contextvars/default.nix
deleted file mode 100644
index 1eda85a6ffe28..0000000000000
--- a/pkgs/development/python-modules/contextvars/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi, isPy36, immutables }:
-
-buildPythonPackage rec {
-  pname = "contextvars";
-  version = "2.4";
-  disabled = !isPy36;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "f38c908aaa59c14335eeea12abea5f443646216c4e29380d7bf34d2018e2c39e";
-  };
-
-  propagatedBuildInputs = [ immutables ];
-
-  meta = {
-    description = "A backport of the Python 3.7 contextvars module for Python 3.6";
-    homepage = "https://github.com/MagicStack/contextvars";
-    license = with lib.licenses; [ asl20 ];
-    maintainers = with lib.maintainers; [ catern ];
-  };
-}
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 0bbc30cd23c27..d5e4af33f601c 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -27,19 +27,19 @@ let
 in
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "38.0.3"; # Also update the hash in vectors.nix
+  version = "38.0.4"; # Also update the hash in vectors.nix
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v75u4ZYVsHqYsdIofWpgc/c0c1tJ7kWxEyTYXvxNXL0=";
+    hash = "sha256-F1wagYuHyayAu3N39VILfzGz7yoABOJCAxm+re22cpA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-lzHLW1N4hZj+nn08NZiPVM/X+SEcIsuZDjEOy0OOkSc=";
+    hash = "sha256-BN0kOblUwgHj5QBf52RY2Jx0nBn03lwoN1O5PEohbwY=";
   };
 
   cargoRoot = "src/rust";
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index f4573a79d102e..4de95b000263d 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -8,7 +8,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "cryptography_vectors";
     inherit version;
-    hash = "sha256-HNr9QvU0jXfk5+R5Gu/R9isWvVUqAnSvyTRlM/4y6SU=";
+    hash = "sha256-bsYmlb7F34ECiN3OrpmK5pHNuKFigI1svJYNPeuafbE=";
   };
 
   # No tests included
diff --git a/pkgs/development/python-modules/dataclasses/default.nix b/pkgs/development/python-modules/dataclasses/default.nix
deleted file mode 100644
index c276e9d000b27..0000000000000
--- a/pkgs/development/python-modules/dataclasses/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi, isPy36 }:
-
-buildPythonPackage rec {
-  pname = "dataclasses";
-  version = "0.8";
-
-  # backport only works on Python 3.6, and is in the standard library in Python 3.7
-  disabled = !isPy36;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "8479067f342acf957dc82ec415d355ab5edb7e7646b90dc6e2fd1d96ad084c97";
-  };
-
-  meta = with lib; {
-    description = "An implementation of PEP 557: Data Classes";
-    homepage = "https://github.com/ericvsmith/dataclasses";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ catern ];
-  };
-}
diff --git a/pkgs/development/python-modules/devtools/default.nix b/pkgs/development/python-modules/devtools/default.nix
index 34004769b1fdf..a6cc42dfe9626 100644
--- a/pkgs/development/python-modules/devtools/default.nix
+++ b/pkgs/development/python-modules/devtools/default.nix
@@ -2,6 +2,7 @@
 , asttokens
 , buildPythonPackage
 , executing
+, hatchling
 , fetchFromGitHub
 , pygments
 , pytest-mock
@@ -11,18 +12,22 @@
 
 buildPythonPackage rec {
   pname = "devtools";
-  version = "0.8.0";
-  format = "setuptools";
+  version = "0.10.0";
+  format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "samuelcolvin";
     repo = "python-${pname}";
     rev = "v${version}";
-    sha256 = "0yavcbxzxi1nfa1k326gsl03y8sadi5z5acamwd8b1bsiv15p757";
+    sha256 = "sha256-x9dL/FE94OixMAmjnmfzZUcYJBqE5P2AAIFsNJF0Fxo=";
   };
 
+  nativeBuildInputs = [
+    hatchling
+  ];
+
   propagatedBuildInputs = [
     asttokens
     executing
diff --git a/pkgs/development/python-modules/easysnmp/default.nix b/pkgs/development/python-modules/easysnmp/default.nix
deleted file mode 100644
index c55bf52a6643a..0000000000000
--- a/pkgs/development/python-modules/easysnmp/default.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-{ lib
-, buildPythonPackage
-, pythonAtLeast
-, fetchFromGitHub
-, net-snmp
-, openssl
-, pytest
-, pytest-cov
-, pytest-flake8
-, pytest-sugar
-, termcolor
-}:
-
-buildPythonPackage rec {
-  pname = "easysnmp";
-  version = "0.2.5";
-
-  # See https://github.com/kamakazikamikaze/easysnmp/issues/108
-  disabled = pythonAtLeast "3.7";
-
-  src = fetchFromGitHub {
-    owner = "kamakazikamikaze";
-    repo = pname;
-    rev = version;
-    sha256 = "1si9iyxqj6z22jzn6m93lwpinsqn20lix2py3jm3g3fmwawkd735";
-  };
-
-  checkInputs = [
-    pytest
-    pytest-cov
-    pytest-flake8
-    pytest-sugar
-    termcolor
-  ];
-
-  buildInputs = [
-    net-snmp
-    openssl
-  ];
-
-  buildPhase = ''
-    python setup.py build bdist_wheel --basedir=${lib.getBin net-snmp}/bin
-  '';
-
-  # Unable to get tests to pass, even running by hand. The pytest tests have
-  # become stale.
-  doCheck = false;
-
-  meta = with lib; {
-    description = "A blazingly fast and Pythonic SNMP library based on the official Net-SNMP bindings";
-    homepage = "https://easysnmp.readthedocs.io/en/latest/";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ WhittlesJr ];
-  };
-}
diff --git a/pkgs/development/python-modules/exceptiongroup/default.nix b/pkgs/development/python-modules/exceptiongroup/default.nix
index 96ce96e27f087..865e14f8e5068 100644
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@@ -1,30 +1,34 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, flit-core
+, fetchFromGitHub
+, flit-scm
 , pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "exceptiongroup";
-  version = "1.0.1";
-  format = "flit";
+  version = "1.0.4";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-c4Zvf4Qu3myx2qQsSvB44gNeX3YH8OLHYsxRuzG757I=";
+  src = fetchFromGitHub {
+    owner = "agronholm";
+    repo = "exceptiongroup";
+    rev = version;
+    hash = "sha256-csyDWVvcsAMzgomb0xq0NbVP7qYQpDv9obBGANlwiVI=";
   };
 
   nativeBuildInputs = [
-    flit-core
+    flit-scm
   ];
 
-  # Tests are only in the source available but tagged releases
-  # are incomplete as files are generated during the release process
-  doCheck = false;
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  checkInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [
     "exceptiongroup"
@@ -33,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Backport of PEP 654 (exception groups)";
     homepage = "https://github.com/agronholm/exceptiongroup";
+    changelog = "https://github.com/agronholm/exceptiongroup/blob/${version}/CHANGES.rst";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/exchangelib/default.nix b/pkgs/development/python-modules/exchangelib/default.nix
index 381cb282db997..4befeed6586a5 100644
--- a/pkgs/development/python-modules/exchangelib/default.nix
+++ b/pkgs/development/python-modules/exchangelib/default.nix
@@ -45,6 +45,12 @@ buildPythonPackage rec {
       url = "https://github.com/ecederstrand/exchangelib/commit/d5d386f54adec8ab02f871332b89e1176c214ba2.diff";
       hash = "sha256-E3Ys6IDJ/yMsvi+1GKbwckkhbNrc9JLM/+GrPtUz+mY=";
     })
+    (fetchpatch {
+      name = "tests-timezones-2.patch";
+      url = "https://github.com/ecederstrand/exchangelib/commit/419eafcd9261bfd0617823ee437204d5556a8271.diff";
+      excludes = [ "tests/test_ewsdatetime.py" ];
+      hash = "sha256-dSp6NkNT5dHOg8XgDi8sR3t3hq46sNtPjUXva2YfFSU=";
+    })
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/executing/default.nix b/pkgs/development/python-modules/executing/default.nix
index 1a6664df67121..0c7cbf2763184 100644
--- a/pkgs/development/python-modules/executing/default.nix
+++ b/pkgs/development/python-modules/executing/default.nix
@@ -3,18 +3,22 @@
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools-scm
+, pytestCheckHook
+, littleutils
+, pythonAtLeast
+, rich
 }:
 
 buildPythonPackage rec {
   pname = "executing";
-  version = "0.8.2";
-  format = "setuptools";
+  version = "1.2.0";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "alexmojaki";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CDZQ9DONn7M+2/GtmM2G6nQPpI9dOd0ca+2F1PGRwO4=";
+    sha256 = "sha256-3M3uSJ5xQ5Ciy8Lz21u9zjju/7SBSFHobCqSiJ6AP8M=";
   };
 
   nativeBuildInputs = [
@@ -25,10 +29,12 @@ buildPythonPackage rec {
     export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
   '';
 
-  # Tests appear to run fine (Ran 22 tests in 4.076s) with setuptoolsCheckPhase
-  # but crash with pytestCheckHook
   checkInputs = [
+    pytestCheckHook
     asttokens
+    littleutils
+  ] ++ lib.optionals (pythonAtLeast "3.11") [
+    rich
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/eyed3/default.nix b/pkgs/development/python-modules/eyed3/default.nix
index 7adbba522e9b8..2b5cc5afba75a 100644
--- a/pkgs/development/python-modules/eyed3/default.nix
+++ b/pkgs/development/python-modules/eyed3/default.nix
@@ -1,13 +1,11 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pythonOlder
 , python
 , isPyPy
 , six
 , filetype
 , deprecation
-, dataclasses
 }:
 
 buildPythonPackage rec {
@@ -25,8 +23,10 @@ buildPythonPackage rec {
   doCheck = false;
 
   propagatedBuildInputs = [
-    six filetype deprecation
-  ] ++ lib.optional (pythonOlder "3.7") dataclasses;
+    deprecation
+    filetype
+    six
+  ];
 
   postInstall = ''
     for prog in "$out/bin/"*; do
diff --git a/pkgs/development/python-modules/foolscap/default.nix b/pkgs/development/python-modules/foolscap/default.nix
index ea0c17d5524a2..09b85c12753e3 100644
--- a/pkgs/development/python-modules/foolscap/default.nix
+++ b/pkgs/development/python-modules/foolscap/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , mock
 , pyopenssl
 , pytestCheckHook
@@ -17,6 +18,14 @@ buildPythonPackage rec {
     sha256 = "sha256-6dGFU4YNk1joXXZi2c2L84JtUbTs1ICgXfv0/EU2P4Q=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-tests-with-twisted-22.10.0.patch";
+      url = "https://github.com/warner/foolscap/commit/c04202eb5d4cf052e650ec2985ea6037605fd79e.patch";
+      hash = "sha256-RldDc18n3WYHdYg0ZmM8PBffIuiGa1NIfdoHs3mEEfc=";
+    })
+  ];
+
   propagatedBuildInputs = [
     mock
     twisted
diff --git a/pkgs/development/python-modules/gruut/default.nix b/pkgs/development/python-modules/gruut/default.nix
index f36c9daa12d86..f9c0425823357 100644
--- a/pkgs/development/python-modules/gruut/default.nix
+++ b/pkgs/development/python-modules/gruut/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , callPackage
-, pythonOlder
 , fetchFromGitHub
 , babel
 , gruut-ipa
@@ -9,7 +8,6 @@
 , jsonlines
 , num2words
 , python-crfsuite
-, dataclasses
 , python
 , networkx
 , glibcLocales
@@ -61,8 +59,6 @@ buildPythonPackage rec {
     python-crfsuite
     dateparser
     networkx
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ] ++ (map (lang: callPackage ./language-pack.nix {
     inherit lang version format src;
   }) langPkgs);
diff --git a/pkgs/development/python-modules/h11/default.nix b/pkgs/development/python-modules/h11/default.nix
index 98dd8eef6cbdc..4f34ca2daafbe 100644
--- a/pkgs/development/python-modules/h11/default.nix
+++ b/pkgs/development/python-modules/h11/default.nix
@@ -3,16 +3,19 @@
 , fetchPypi
 , pytestCheckHook
 , pythonOlder
+, httpcore
+, httpx
+, wsproto
 }:
 
 buildPythonPackage rec {
   pname = "h11";
-  version = "0.13.0";
+  version = "0.14.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-cIE8ETUIeiSKTTjMDhoBgf+rIYgUGpPq9WeUDDlX/wY=";
+    sha256 = "sha256-jxn7vpnnJCD/NcALJ6NMuZN+kCqLgQ4siDAMbwo7aZ0=";
   };
 
   checkInputs = [ pytestCheckHook ];
@@ -20,6 +23,10 @@ buildPythonPackage rec {
   # Some of the tests use localhost networking.
   __darwinAllowLocalNetworking = true;
 
+  passthru.tests = {
+    inherit httpcore httpx wsproto;
+  };
+
   meta = with lib; {
     description = "Pure-Python, bring-your-own-I/O implementation of HTTP/1.1";
     homepage = "https://github.com/python-hyper/h11";
diff --git a/pkgs/development/python-modules/httpcore/default.nix b/pkgs/development/python-modules/httpcore/default.nix
index 5016ece96f2f5..61a3b8d732352 100644
--- a/pkgs/development/python-modules/httpcore/default.nix
+++ b/pkgs/development/python-modules/httpcore/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "httpcore";
-  version = "0.15.0";
+  version = "0.16.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,14 +26,9 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = version;
-    hash = "sha256-FF3Yzac9nkVcA5bHVOz2ymvOelSfJ0K6oU8UWpBDcmo=";
+    hash = "sha256-bwGZ/B0jlvc1BmXVTo7gMP6PJIQuCHclkHjKQCgMsyU=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "h11>=0.11,<0.13" "h11>=0.11,<0.14"
-  '';
-
   propagatedBuildInputs = [
     anyio
     certifi
@@ -63,6 +58,12 @@ buildPythonPackage rec {
     "httpcore"
   ];
 
+  preCheck = ''
+    # remove upstreams pytest flags which cause:
+    # httpcore.ConnectError: TLS/SSL connection has been closed (EOF) (_ssl.c:997)
+    rm setup.cfg
+  '';
+
   pytestFlagsArray = [
     "--asyncio-mode=strict"
   ];
diff --git a/pkgs/development/python-modules/httpx/default.nix b/pkgs/development/python-modules/httpx/default.nix
index 4085a2e0893f2..104fabd2c50c4 100644
--- a/pkgs/development/python-modules/httpx/default.nix
+++ b/pkgs/development/python-modules/httpx/default.nix
@@ -8,8 +8,11 @@
 , click
 , fetchFromGitHub
 , h2
+, hatch-fancy-pypi-readme
+, hatchling
 , httpcore
 , isPyPy
+, multipart
 , pygments
 , python
 , pythonOlder
@@ -26,8 +29,8 @@
 
 buildPythonPackage rec {
   pname = "httpx";
-  version = "0.23.0";
-  format = "setuptools";
+  version = "0.23.1";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
@@ -35,9 +38,14 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = version;
-    hash = "sha256-s11Yeizm3y3w5D6ACQ2wp/KJ0+1ALY/R71IlTP2pMC4=";
+    hash = "sha256-1gRBHbGFUkaFvVgHHoXfpo9j0L074SyevFwMY202+uk=";
   };
 
+  nativeBuildInputs = [
+    hatch-fancy-pypi-readme
+    hatchling
+  ];
+
   propagatedBuildInputs = [
     certifi
     httpcore
@@ -69,6 +77,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     chardet
+    multipart
     pytestCheckHook
     pytest-asyncio
     pytest-trio
@@ -79,7 +88,7 @@ buildPythonPackage rec {
     ++ passthru.optional-dependencies.socks;
 
   postPatch = ''
-    substituteInPlace setup.py \
+    substituteInPlace pyproject.toml \
       --replace "rfc3986[idna2008]>=1.3,<2" "rfc3986>=1.3"
   '';
 
@@ -112,6 +121,7 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
+    changelog = "https://github.com/encode/httpx/blob/${src.rev}/CHANGELOG.md";
     description = "The next generation HTTP client";
     homepage = "https://github.com/encode/httpx";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index 9c12520e9718a..e1bed7184287f 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -44,6 +44,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  # https://github.com/allenporter/ical/issues/136
+  disabledTests = [ "test_all_zoneinfo" ];
+
   pythonImportsCheck = [
     "ical"
   ];
diff --git a/pkgs/development/python-modules/ircrobots/default.nix b/pkgs/development/python-modules/ircrobots/default.nix
index e16ac2449a7d3..8351ff3d86be1 100644
--- a/pkgs/development/python-modules/ircrobots/default.nix
+++ b/pkgs/development/python-modules/ircrobots/default.nix
@@ -5,7 +5,6 @@
 , anyio
 , asyncio-rlock
 , asyncio-throttle
-, dataclasses
 , ircstates
 , async_stagger
 , async-timeout
@@ -15,7 +14,7 @@
 buildPythonPackage rec {
   pname = "ircrobots";
   version = "0.4.6";
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "jesopo";
@@ -38,8 +37,6 @@ buildPythonPackage rec {
     ircstates
     async_stagger
     async-timeout
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/labelbox/default.nix b/pkgs/development/python-modules/labelbox/default.nix
index 9b0b241c5ed14..08a1fa5ca5eae 100644
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@@ -2,7 +2,6 @@
 , backoff
 , backports-datetime-fromisoformat
 , buildPythonPackage
-, dataclasses
 , fetchFromGitHub
 , google-api-core
 , jinja2
@@ -20,7 +19,7 @@
 buildPythonPackage rec {
   pname = "labelbox";
   version = "3.24.1";
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "Labelbox";
@@ -32,7 +31,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     backoff
     backports-datetime-fromisoformat
-    dataclasses
     google-api-core
     jinja2
     ndjson
diff --git a/pkgs/development/python-modules/mailcap-fix/default.nix b/pkgs/development/python-modules/mailcap-fix/default.nix
index da735d9d048de..3d644bec3a93c 100644
--- a/pkgs/development/python-modules/mailcap-fix/default.nix
+++ b/pkgs/development/python-modules/mailcap-fix/default.nix
@@ -1,13 +1,12 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy36
 }:
 
 buildPythonPackage rec {
   pname = "mailcap-fix";
   version = "1.0.1";
-  disabled = isPy36; # this fix is merged into python 3.6
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/multipart/default.nix b/pkgs/development/python-modules/multipart/default.nix
new file mode 100644
index 0000000000000..6d441843162d0
--- /dev/null
+++ b/pkgs/development/python-modules/multipart/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "multipart";
+  version = "0.2.4";
+
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "06ba205360bc7096fefe618e4f1e9b2cdb890b4f2157053a81f386912a2522cb";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "dont-test-semicolon-separators-in-urlencoded-data.patch";
+      url = "https://github.com/defnull/multipart/commit/4d4ac6b79c453918ebf40c690e8d57d982ee840b.patch";
+      hash = "sha256-rMeMhQEhonWAHzy5M8Im5mL6km5a9O0CGVOV+T3UNqo=";
+    })
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "multipart" ];
+
+  meta = {
+    description = "Parser for multipart/form-data";
+    homepage = "https://github.com/defnull/multipart";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/pathy/default.nix b/pkgs/development/python-modules/pathy/default.nix
index 30cdd782df2ed..d937c0a43128b 100644
--- a/pkgs/development/python-modules/pathy/default.nix
+++ b/pkgs/development/python-modules/pathy/default.nix
@@ -1,6 +1,5 @@
 { lib
 , buildPythonPackage
-, dataclasses
 , fetchPypi
 , fetchpatch
 , google-cloud-storage
@@ -16,7 +15,7 @@ buildPythonPackage rec {
   version = "0.6.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -27,8 +26,6 @@ buildPythonPackage rec {
     smart-open
     typer
     google-cloud-storage
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pixcat/default.nix b/pkgs/development/python-modules/pixcat/default.nix
index 026685cd63416..90fdae5dcf03e 100644
--- a/pkgs/development/python-modules/pixcat/default.nix
+++ b/pkgs/development/python-modules/pixcat/default.nix
@@ -5,7 +5,6 @@
 , docopt
 , pillow
 , requests
-, dataclasses
 , pythonOlder
 }:
 
@@ -13,7 +12,7 @@ buildPythonPackage rec {
   pname = "pixcat";
   version = "0.1.4";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/poetry/default.nix b/pkgs/development/python-modules/poetry/default.nix
index 8f62c3e6eb168..2e81f7e553122 100644
--- a/pkgs/development/python-modules/poetry/default.nix
+++ b/pkgs/development/python-modules/poetry/default.nix
@@ -5,7 +5,6 @@
 , cachy
 , cleo
 , crashtest
-, dataclasses
 , deepdiff
 , dulwich
 , fetchFromGitHub
diff --git a/pkgs/development/python-modules/pudb/default.nix b/pkgs/development/python-modules/pudb/default.nix
index 1f13859449022..96f3370365bd0 100644
--- a/pkgs/development/python-modules/pudb/default.nix
+++ b/pkgs/development/python-modules/pudb/default.nix
@@ -1,6 +1,5 @@
 { lib
 , buildPythonPackage
-, dataclasses
 , fetchPypi
 , jedi
 , pygments
@@ -16,7 +15,7 @@ buildPythonPackage rec {
   version = "2022.1.3";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
@@ -28,8 +27,6 @@ buildPythonPackage rec {
     pygments
     urwid
     urwid-readline
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 0b15832ba28a5..1d3d3d0d9e081 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -3,7 +3,6 @@
 , callPackage
 , fetchFromGitHub
 , fetchpatch
-, cffi
 , gmp
 }:
 
@@ -12,14 +11,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pycryptodome";
-  version = "3.15.0";
+  version = "3.16.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Legrandin";
     repo = "pycryptodome";
     rev = "v${version}";
-    hash = "sha256-SPRoAfwP1MFlVzZsVWmXDWUY5Yje7eg7d+9zJhZNXrw=";
+    hash = "sha256-8EAgeAU3HQiPrMKOtoVQQLbgq47cbveU2eQYp15XS/U=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pycryptodome/vectors.nix b/pkgs/development/python-modules/pycryptodome/vectors.nix
index f6a2b715ad916..89df4507867e7 100644
--- a/pkgs/development/python-modules/pycryptodome/vectors.nix
+++ b/pkgs/development/python-modules/pycryptodome/vectors.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "pycryptodome-test-vectors";
-  version = "1.0.8";
+  version = "1.0.10";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3BTh7as4CikvVfUx2xBZlUOaq/dAQNNFHpuRxWg/5N0=";
+    hash = "sha256-oqgHWAw0Xrc22eAuY6+Q/H90tL9Acz6V0EJp060hH2Q=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/pyhamcrest/default.nix b/pkgs/development/python-modules/pyhamcrest/default.nix
index ffe11cc140b3c..8abf3b8ea44b6 100644
--- a/pkgs/development/python-modules/pyhamcrest/default.nix
+++ b/pkgs/development/python-modules/pyhamcrest/default.nix
@@ -1,19 +1,20 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, hatchling
 , hatch-vcs
+, hatchling
 , numpy
-, pythonOlder
 , pytest-xdist
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyhamcrest";
   version = "2.0.4";
   format = "pyproject";
-  disabled = pythonOlder "3.6";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "hamcrest";
@@ -22,11 +23,9 @@ buildPythonPackage rec {
     hash = "sha256-CIkttiijbJCR0zdmwM5JvFogQKYuHUXHJhdyWonHcGk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
-    hatchling
     hatch-vcs
+    hatchling
   ];
 
   checkInputs = [
@@ -35,12 +34,19 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'dynamic = ["version"]' 'version = "${version}"'
+  '';
+
+  pythonImportsCheck = [
+    "hamcrest"
+  ];
+
   meta = with lib; {
-    homepage = "https://github.com/hamcrest/PyHamcrest";
     description = "Hamcrest framework for matcher objects";
+    homepage = "https://github.com/hamcrest/PyHamcrest";
     license = licenses.bsd3;
-    maintainers = with maintainers; [
-      alunduil
-    ];
+    maintainers = with maintainers; [ alunduil ];
   };
 }
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 2a81ebf40efe0..082ebdfae6fdf 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , openssl
 , cryptography
 , pytestCheckHook
@@ -21,15 +22,19 @@ buildPythonPackage rec {
     sha256 = "sha256-eoO3snLdWVIi1nL1zimqAw8fuDdjDvIp9i5y45XOiWg=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-flaky-darwin-handshake-tests.patch";
+      url = "https://github.com/pyca/pyopenssl/commit/8a75898356806784caf742e8277ef03de830ce11.patch";
+      hash = "sha256-UVsZ8Nq1jUTZhOUAilRgdtqMYp4AN7qvWHqc6RleqRI=";
+    })
+  ];
+
   postPatch = ''
     # remove cryptography pin
     sed "/cryptography/ s/,<[0-9]*//g" setup.py
   '';
 
-  # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
-  # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
-  doCheck = !stdenv.isDarwin;
-
   nativeBuildInputs = [ openssl ];
   propagatedBuildInputs = [ cryptography ];
 
@@ -79,7 +84,5 @@ buildPythonPackage rec {
     homepage = "https://github.com/pyca/pyopenssl";
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
-    # https://github.com/pyca/pyopenssl/issues/873
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/development/python-modules/pytest-freezegun/default.nix b/pkgs/development/python-modules/pytest-freezegun/default.nix
index 3ba67867a1aaa..56752fe482204 100644
--- a/pkgs/development/python-modules/pytest-freezegun/default.nix
+++ b/pkgs/development/python-modules/pytest-freezegun/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , freezegun
 , pytest
 , pytestCheckHook
@@ -17,6 +18,15 @@ buildPythonPackage rec {
     sha256 = "10c4pbh03b4s1q8cjd75lr0fvyf9id0zmdk29566qqsmaz28npas";
   };
 
+  patches = [
+    (fetchpatch {
+      # https://github.com/ktosiek/pytest-freezegun/pull/38
+      name = "pytest-freezegun-drop-distutils.patch";
+      url = "https://github.com/ktosiek/pytest-freezegun/commit/03d7107a877e8f07617f931a379f567d89060085.patch";
+      hash = "sha256-/7GTQdidVbE2LT5hwxjEc2dr+aWr6TX1131U4KMQhns=";
+    })
+  ];
+
   buildInputs = [ pytest ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/reqif/default.nix b/pkgs/development/python-modules/reqif/default.nix
index ace3052e5a9cd..1e5ecc718d9d2 100644
--- a/pkgs/development/python-modules/reqif/default.nix
+++ b/pkgs/development/python-modules/reqif/default.nix
@@ -1,13 +1,11 @@
 { lib
 , buildPythonPackage
 , python
-, pythonOlder
 , fetchFromGitHub
 , poetry-core
 , beautifulsoup4
 , lxml
 , jinja2
-, dataclasses
 , pytestCheckHook
 }:
 
@@ -39,8 +37,6 @@ buildPythonPackage rec {
     beautifulsoup4
     lxml
     jinja2
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/requests/0001-Prefer-NixOS-Nix-default-CA-bundles-over-certifi.patch b/pkgs/development/python-modules/requests/0001-Prefer-NixOS-Nix-default-CA-bundles-over-certifi.patch
deleted file mode 100644
index de6a4b5c1b575..0000000000000
--- a/pkgs/development/python-modules/requests/0001-Prefer-NixOS-Nix-default-CA-bundles-over-certifi.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From b36083efafec5a3c1c5864cd0b62367ddf3856ae Mon Sep 17 00:00:00 2001
-From: Keshav Kini <keshav.kini@gmail.com>
-Date: Sun, 16 May 2021 20:35:24 -0700
-Subject: [PATCH] Prefer NixOS/Nix default CA bundles over certifi
-
-Normally, requests gets its default CA bundle from the certifi
-package.  On NixOS and when using Nix on non-NixOS platforms, we would
-rather default to using our own certificate bundles controlled by the
-Nix/NixOS user.
-
-This commit overrides requests.certs.where(), which previously was
-just aliased to certifi.where(), so that now it does the following:
-
-- When run by Nix on non-NixOS, the environment variable
-  $NIX_SSL_CERT_FILE will point to the CA bundle we're using, so we
-  use that.
-
-- When running on NixOS, the CA bundle we're using has the static path
-  /etc/ssl/certs/ca-certificates.crt , so we use that.
-
-- Otherwise, we fall back to the original behavior of using certifi's
-  CA bundle.  Higher in the call stack, users of requests can also
-  explicitly specify a CA bundle to use, which overrides all this
-  logic.
----
- requests/certs.py | 18 +++++++++++++++++-
- 1 file changed, 17 insertions(+), 1 deletion(-)
-
-diff --git a/requests/certs.py b/requests/certs.py
-index d1a378d7..faf462b7 100644
---- a/requests/certs.py
-+++ b/requests/certs.py
-@@ -12,7 +12,23 @@ If you are packaging Requests, e.g., for a Linux distribution or a managed
- environment, you can change the definition of where() to return a separately
- packaged CA bundle.
- """
--from certifi import where
-+
-+import os
-+
-+import certifi
-+
-+
-+def where():
-+    nix_ssl_cert_file = os.getenv("NIX_SSL_CERT_FILE")
-+    if nix_ssl_cert_file and os.path.exists(nix_ssl_cert_file):
-+        return nix_ssl_cert_file
-+
-+    nixos_ca_bundle = "/etc/ssl/certs/ca-certificates.crt"
-+    if os.path.exists(nixos_ca_bundle):
-+        return nixos_ca_bundle
-+
-+    return certifi.where()
-+
- 
- if __name__ == '__main__':
-     print(where())
--- 
-2.31.1
-
diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index 5eab25fa3e15d..d7230c532eb29 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -27,11 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-fFWZsQL+3apmHIJsVqtP7ii/0X9avKHrvj5/GdfJeYM=";
   };
 
-  patches = [
-    # Use the default NixOS CA bundle from the certifi package
-    ./0001-Prefer-NixOS-Nix-default-CA-bundles-over-certifi.patch
-  ];
-
   propagatedBuildInputs = [
     brotlicffi
     certifi
diff --git a/pkgs/development/python-modules/responses/default.nix b/pkgs/development/python-modules/responses/default.nix
index 21e3dd38cdb8f..15a538cbf3b7e 100644
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@@ -1,16 +1,20 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytest-localserver
+, pytest-asyncio
+, pytest-httpserver
 , pytestCheckHook
 , pythonOlder
 , requests
+, toml
+, types-toml
+, typing-extensions
 , urllib3
 }:
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.21.0";
+  version = "0.22.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,16 +25,22 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = pname;
     rev = version;
-    hash = "sha256-qYohrXrQkUBPo7yC+ZOwidDaCg/2nteXKAOCUvR4k2Q=";
+    hash = "sha256-VOIpowxPvYmufnj9MM/vMtZQDIOxorAhMCNK0fX/j1U=";
   };
 
   propagatedBuildInputs = [
     requests
+    toml
+    types-toml
     urllib3
+  ]  ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
   ];
 
+
   checkInputs = [
-    pytest-localserver
+    pytest-asyncio
+    pytest-httpserver
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/respx/default.nix b/pkgs/development/python-modules/respx/default.nix
index 4d4e4e1175d80..cdf4ea4f0549a 100644
--- a/pkgs/development/python-modules/respx/default.nix
+++ b/pkgs/development/python-modules/respx/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "respx";
-  version = "0.20.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "lundberg";
     repo = pname;
     rev = version;
-    sha256 = "sha256-xb5jb+l6wA1v/r2yGUB6IuUVXIaTc+3O/w5xn/+A74o=";
+    sha256 = "sha256-Qs3+NWMKiAFlKTTosdyHOxWRPKFlYQD20+MKiKR371U=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rich/default.nix b/pkgs/development/python-modules/rich/default.nix
index 4f87364cfe20f..5d9c1f45c3b30 100644
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@@ -3,7 +3,6 @@
 , fetchFromGitHub
 , pythonOlder
 , CommonMark
-, dataclasses
 , poetry-core
 , pygments
 , typing-extensions
@@ -20,7 +19,7 @@ buildPythonPackage rec {
   pname = "rich";
   version = "12.6.0";
   format = "pyproject";
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "Textualize";
@@ -34,8 +33,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     CommonMark
     pygments
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ] ++ lib.optionals (pythonOlder "3.9") [
     typing-extensions
   ];
diff --git a/pkgs/development/python-modules/rig/default.nix b/pkgs/development/python-modules/rig/default.nix
deleted file mode 100644
index bc43aac3551ad..0000000000000
--- a/pkgs/development/python-modules/rig/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi
-, isPy35, isPy27
-, numpy, pytz, six, enum-compat, sentinel
-}:
-
-buildPythonPackage rec {
-  pname = "rig";
-  version = "2.4.1";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "5a3896dbde3f291c5dd34769e7329ef5d5e4da34fee53479bd13dc5e5d540b8a";
-  };
-
-  propagatedBuildInputs = [ numpy pytz six sentinel enum-compat ];
-
-  # This is the list of officially supported versions. Other versions may work
-  # as well.
-  disabled = !(isPy27 || isPy35);
-
-  # Test Phase is only supported in development sources.
-  doCheck = false;
-
-  meta = with lib; {
-    description = "A collection of tools for developing SpiNNaker applications";
-    homepage = "https://github.com/project-rig/rig";
-    license = licenses.gpl2;
-  };
-}
diff --git a/pkgs/development/python-modules/screeninfo/default.nix b/pkgs/development/python-modules/screeninfo/default.nix
index 574d3159494ac..6789c6b76c45f 100644
--- a/pkgs/development/python-modules/screeninfo/default.nix
+++ b/pkgs/development/python-modules/screeninfo/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , buildPythonPackage
-, dataclasses
 , fetchFromGitHub
 , libX11
 , libXinerama
@@ -16,7 +15,7 @@ buildPythonPackage rec {
   version = "0.8.1";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "rr-";
@@ -29,10 +28,6 @@ buildPythonPackage rec {
     poetry-core
   ];
 
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.7") [
-    dataclasses
-  ];
-
   postPatch = ''
     substituteInPlace screeninfo/enumerators/xinerama.py \
       --replace 'load_library("X11")' 'ctypes.cdll.LoadLibrary("${libX11}/lib/libX11.so")' \
diff --git a/pkgs/development/python-modules/simple-di/default.nix b/pkgs/development/python-modules/simple-di/default.nix
index 150eb52f8d4ed..79437c4a0b344 100644
--- a/pkgs/development/python-modules/simple-di/default.nix
+++ b/pkgs/development/python-modules/simple-di/default.nix
@@ -4,7 +4,6 @@
 , fetchPypi
 , setuptools
 , typing-extensions
-, dataclasses
 }:
 
 buildPythonPackage rec {
@@ -23,8 +22,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     setuptools
     typing-extensions
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/skia-pathops/default.nix b/pkgs/development/python-modules/skia-pathops/default.nix
index 4da35b98f4a4a..49afcf8109359 100644
--- a/pkgs/development/python-modules/skia-pathops/default.nix
+++ b/pkgs/development/python-modules/skia-pathops/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "skia-pathops";
-  version = "0.7.2";
+  version = "0.7.4";
 
   src = fetchPypi {
     pname = "skia-pathops";
     inherit version;
     extension = "zip";
-    sha256 = "sha256-Gdhcmv77oVr5KxPIiJlk935jgvWPQsYEC0AZ6yjLppA=";
+    sha256 = "sha256-Ci/e6Ht62wGMv6bpXvnkKZ7WOwCAvidnejD/77ypE1A=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sniffio/default.nix b/pkgs/development/python-modules/sniffio/default.nix
index 86e37168c8996..0a8dc4aef4e58 100644
--- a/pkgs/development/python-modules/sniffio/default.nix
+++ b/pkgs/development/python-modules/sniffio/default.nix
@@ -1,27 +1,33 @@
-{ buildPythonPackage, lib, fetchPypi, glibcLocales, isPy3k, contextvars
-, pythonOlder, pytest, curio
+{ buildPythonPackage
+, lib
+, fetchPypi
+, glibcLocales
+, isPy3k
+, pythonOlder
+, pytestCheckHook
+, curio
 }:
 
 buildPythonPackage rec {
   pname = "sniffio";
   version = "1.3.0";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-5gMFxeXTFPU4klm38iqqM9j33uSXYxGSNK83VcVbkQE=";
+    hash = "sha256-5gMFxeXTFPU4klm38iqqM9j33uSXYxGSNK83VcVbkQE=";
   };
 
   disabled = !isPy3k;
 
-  buildInputs = [ glibcLocales ];
+  buildInputs = [
+    glibcLocales
+  ];
 
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.7") [ contextvars ];
-
-  checkInputs = [ pytest curio ];
-
-  checkPhase = ''
-    pytest
-  '';
+  checkInputs = [
+    curio
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/python-trio/sniffio";
diff --git a/pkgs/development/python-modules/spacy-transformers/default.nix b/pkgs/development/python-modules/spacy-transformers/default.nix
index 914e2cb5153e5..14969a61b1023 100644
--- a/pkgs/development/python-modules/spacy-transformers/default.nix
+++ b/pkgs/development/python-modules/spacy-transformers/default.nix
@@ -2,7 +2,6 @@
 , callPackage
 , fetchPypi
 , buildPythonPackage
-, dataclasses
 , torch
 , pythonOlder
 , spacy
@@ -16,7 +15,7 @@ buildPythonPackage rec {
   version = "1.1.8";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -29,8 +28,6 @@ buildPythonPackage rec {
     spacy-alignments
     srsly
     transformers
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/testtools/default.nix b/pkgs/development/python-modules/testtools/default.nix
index 430d0374ef20d..e20bd74a6aa0c 100644
--- a/pkgs/development/python-modules/testtools/default.nix
+++ b/pkgs/development/python-modules/testtools/default.nix
@@ -5,7 +5,6 @@
 , pbr
 , python-mimeparse
 , extras
-, unittest2
 , traceback2
 , testscenarios
 }:
diff --git a/pkgs/development/python-modules/thinc/default.nix b/pkgs/development/python-modules/thinc/default.nix
index 334411fe26c99..1a43bcbbc4ed8 100644
--- a/pkgs/development/python-modules/thinc/default.nix
+++ b/pkgs/development/python-modules/thinc/default.nix
@@ -5,13 +5,11 @@
 , buildPythonPackage
 , catalogue
 , confection
-, contextvars
 , CoreFoundation
 , CoreGraphics
 , CoreVideo
 , cymem
 , cython
-, dataclasses
 , fetchPypi
 , hypothesis
 , mock
@@ -34,7 +32,7 @@ buildPythonPackage rec {
   version = "8.1.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -65,9 +63,6 @@ buildPythonPackage rec {
     wasabi
   ] ++ lib.optionals (pythonOlder "3.8") [
     typing-extensions
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    contextvars
-    dataclasses
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/trio/default.nix b/pkgs/development/python-modules/trio/default.nix
index dde1391034546..7bbfb6f2ca9c1 100644
--- a/pkgs/development/python-modules/trio/default.nix
+++ b/pkgs/development/python-modules/trio/default.nix
@@ -4,7 +4,6 @@
 , async_generator
 , idna
 , outcome
-, contextvars
 , pytestCheckHook
 , pyopenssl
 , trustme
@@ -19,7 +18,7 @@
 buildPythonPackage rec {
   pname = "trio";
   version = "0.21.0";
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -33,7 +32,7 @@ buildPythonPackage rec {
     idna
     outcome
     sniffio
-  ] ++ lib.optionals (pythonOlder "3.7") [ contextvars ];
+  ];
 
   # tests are failing on Darwin
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 86e009d55c408..03a6045372bb3 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -10,7 +10,6 @@
 , automat
 , bcrypt
 , constantly
-, contextvars
 , cryptography
 , git
 , glibcLocales
@@ -144,7 +143,6 @@ buildPythonPackage rec {
     optional-dependencies = rec {
       conch = [ appdirs bcrypt cryptography pyasn1 ];
       conch_nacl = conch ++ [ pynacl ];
-      contextvars = lib.optionals (pythonOlder "3.7") [ contextvars ];
       http2 = [ h2 priority ];
       serial = [ pyserial ];
       tls = [ idna pyopenssl service-identity ];
diff --git a/pkgs/development/python-modules/tzdata/default.nix b/pkgs/development/python-modules/tzdata/default.nix
index 2e3cdafc8a125..e908a10b43cb1 100644
--- a/pkgs/development/python-modules/tzdata/default.nix
+++ b/pkgs/development/python-modules/tzdata/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "tzdata";
-  version = "2022.6";
+  version = "2022.7";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kfEdtFAzhZKMFVmMmFc+OvB+cikYG+5Tdb0w8Wld3K4=";
+    hash = "sha256-/l+Gbt3YuW6fy6l4+OUDyQmxnqfv2hHlLjlJS606e/o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/unittest2/collections-compat.patch b/pkgs/development/python-modules/unittest2/collections-compat.patch
deleted file mode 100644
index 350c9d7167837..0000000000000
--- a/pkgs/development/python-modules/unittest2/collections-compat.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff --git a/unittest2/compatibility.py b/unittest2/compatibility.py
-index 9e5f1a5..473957c 100644
---- a/unittest2/compatibility.py
-+++ b/unittest2/compatibility.py
-@@ -1,4 +1,5 @@
- import collections
-+import collections.abc
- import os
- import sys
- 
-@@ -140,7 +141,7 @@ except ImportError:
- ###  ChainMap (helper for configparser and string.Template)
- ########################################################################
- 
--class ChainMap(collections.MutableMapping):
-+class ChainMap(collections.abc.MutableMapping):
-     ''' A ChainMap groups multiple dicts (or other mappings) together
-     to create a single, updateable view.
- 
diff --git a/pkgs/development/python-modules/unittest2/default.nix b/pkgs/development/python-modules/unittest2/default.nix
deleted file mode 100644
index 786b8996f83bd..0000000000000
--- a/pkgs/development/python-modules/unittest2/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, six
-, traceback2
-, pythonAtLeast
-}:
-
-buildPythonPackage rec {
-  version = "1.1.0";
-  pname = "unittest2";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0y855kmx7a8rnf81d3lh5lyxai1908xjp0laf4glwa4c8472m212";
-  };
-
-  patches = lib.optionals (pythonAtLeast "3.7") [
-    ./collections-compat.patch
-  ];
-
-  propagatedBuildInputs = [ six traceback2 ];
-
-  # 1.0.0 and up create a circle dependency with traceback2/pbr
-  doCheck = false;
-
-  postPatch = ''
-    # argparse is needed for python < 2.7, which we do not support anymore.
-    substituteInPlace setup.py --replace "argparse" ""
-
-    # fixes a transient error when collecting tests, see https://bugs.launchpad.net/python-neutronclient/+bug/1508547
-    sed -i '510i\        return None, False' unittest2/loader.py
-    # https://github.com/pypa/packaging/pull/36
-    sed -i 's/version=VERSION/version=str(VERSION)/' setup.py
-  '';
-
-  meta = with lib; {
-    description = "A backport of the new features added to the unittest testing framework";
-    homepage = "https://pypi.org/project/unittest2/";
-    license = licenses.bsd0;
-  };
-}
diff --git a/pkgs/development/python-modules/werkzeug/default.nix b/pkgs/development/python-modules/werkzeug/default.nix
index 8d3e0769786bb..5562fd13b979f 100644
--- a/pkgs/development/python-modules/werkzeug/default.nix
+++ b/pkgs/development/python-modules/werkzeug/default.nix
@@ -4,7 +4,6 @@
 , pythonOlder
 , fetchPypi
 , watchdog
-, dataclasses
 , ephemeral-port-reserve
 , pytest-timeout
 , pytest-xprocess
@@ -32,8 +31,6 @@ buildPythonPackage rec {
   ] ++ lib.optionals (!stdenv.isDarwin) [
     # watchdog requires macos-sdk 10.13+
     watchdog
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/xxhash/default.nix b/pkgs/development/python-modules/xxhash/default.nix
index ff4eeff354594..6587843873541 100644
--- a/pkgs/development/python-modules/xxhash/default.nix
+++ b/pkgs/development/python-modules/xxhash/default.nix
@@ -5,12 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "3.0.0";
+  version = "3.1.0";
   pname = "xxhash";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-MLLZeq8R+xIgI/a0TruXxpVengDXRhqWQVygMLXOucc=";
+    sha256 = "sha256-rCGx4h3G/f7ppXtT9Hd1OdU6hPLhVGo/gC8Vn5lmvcE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python2-modules/cffi/default.nix b/pkgs/development/python2-modules/cffi/default.nix
new file mode 100644
index 0000000000000..adeda6e90d229
--- /dev/null
+++ b/pkgs/development/python2-modules/cffi/default.nix
@@ -0,0 +1,45 @@
+{ lib, stdenv, cffi }:
+
+if cffi == null then null else cffi.overridePythonAttrs {
+  disabledTests = lib.optionals stdenv.isDarwin [
+    # cannot load library 'c'
+    "test_FILE"
+    "test_FILE_object"
+    "test_FILE_only_for_FILE_arg"
+    "test_load_and_call_function"
+    "test_load_library"
+
+    # cannot load library 'dl'
+    "test_dlopen_handle"
+
+    # cannot load library 'm'
+    "test_dir_on_dlopen_lib"
+    "test_dlclose"
+    "test_dlopen"
+    "test_dlopen_constant"
+    "test_dlopen_flags"
+    "test_function_typedef"
+    "test_line_continuation_in_defines"
+    "test_missing_function"
+    "test_remove_comments"
+    "test_remove_line_continuation_comments"
+    "test_simple"
+    "test_sin"
+    "test_sinf"
+    "test_stdcall_only_on_windows"
+    "test_wraps_from_stdlib"
+
+    # MemoryError
+    "test_callback_as_function_argument"
+    "test_callback_crash"
+    "test_callback_decorator"
+    "test_callback_large_struct"
+    "test_callback_returning_void"
+    "test_cast_functionptr_and_int"
+    "test_function_pointer"
+    "test_functionptr_intptr_return"
+    "test_functionptr_simple"
+    "test_functionptr_void_return"
+    "test_functionptr_voidptr_return"
+  ];
+}
diff --git a/pkgs/development/python2-modules/contextlib2/default.nix b/pkgs/development/python2-modules/contextlib2/default.nix
index 38d9fb696e281..063039448feab 100644
--- a/pkgs/development/python2-modules/contextlib2/default.nix
+++ b/pkgs/development/python2-modules/contextlib2/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, unittest2
 }:
 
 buildPythonPackage rec {
@@ -13,7 +12,8 @@ buildPythonPackage rec {
     sha256 = "01f490098c18b19d2bd5bb5dc445b2054d2fa97f09a4280ba2c5f3c394c8162e";
   };
 
-  checkInputs = [ unittest2 ];
+  # requires unittest2, which has been removed
+  doCheck = false;
 
   meta = {
     description = "Backports and enhancements for the contextlib module";
diff --git a/pkgs/development/tools/build-managers/gnumake/default.nix b/pkgs/development/tools/build-managers/gnumake/default.nix
index 7a6b78ec084ba..add4fd0d35735 100644
--- a/pkgs/development/tools/build-managers/gnumake/default.nix
+++ b/pkgs/development/tools/build-managers/gnumake/default.nix
@@ -14,11 +14,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnumake";
-  version = "4.3";
+  version = "4.4";
 
   src = fetchurl {
     url = "mirror://gnu/make/make-${version}.tar.gz";
-    sha256 = "06cfqzpqsvdnsxbysl5p2fgdgxgl9y4p7scpnrfa8z2zgkjdspz0";
+    sha256 = "sha256-WB9NToctp0s5Qch0IViYp9NYAvA3Mr3M7h1KeXkQXRg=";
   };
 
   # to update apply these patches with `git am *.patch` to https://git.savannah.gnu.org/git/make.git
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 0ad6d5a2acfe5..7e34249f20755 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -127,16 +127,16 @@ rec {
   # https://docs.gradle.org/current/userguide/compatibility.html
 
   gradle_7 = gen {
-    version = "7.5";
-    nativeVersion = "0.22-milestone-23";
-    sha256 = "1hjifd98dif0qy6vkqp56v9z7id5cf2bfkdd71ld8nsqqlig51yb";
+    version = "7.6";
+    nativeVersion = "0.22-milestone-24";
+    sha256 = "0jwycvzv8a5v2bhg5d8zccr2csr3sf9y5mrr9d2ap44p09a8r9kv";
     defaultJava = jdk17;
   };
 
   gradle_6 = gen {
-    version = "6.9.2";
+    version = "6.9.3";
     nativeVersion = "0.22-milestone-20";
-    sha256 = "13qyk3f6namw27ynh6nxljxpk9r3l12vxl3f0qpglprdf3c6ydcb";
+    sha256 = "0p83zgszmrwa26a4q8nvzva2af5lfzy6xvcs57y9588smsw51wyw";
     defaultJava = jdk11;
   };
 
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 9fef483ff0e16..5f4fa56bd1e1f 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -9,11 +9,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "0.63.1";
+  version = "0.64.1";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "Bv4TKXIT1v8BIcXVqrJaVu+Tj/7FdBTtYIb9onLLZek=";
+    sha256 = "sha256-Oo4DDCM094IIX4FicGLMbUpnce3zHgVf/jdPnmsImrk=";
   };
 
   patches = [
@@ -52,15 +52,6 @@ python3.pkgs.buildPythonApplication rec {
     # https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
     ./boost-Do-not-add-system-paths-on-nix.patch
 
-    # Prevent Meson from passing -O0 in buildtype=plain.
-    # Nixpkgs enables fortifications which do not work without optimizations.
-    # https://github.com/mesonbuild/meson/pull/10593
-    (fetchpatch {
-      url = "https://github.com/mesonbuild/meson/commit/f9bfeb2add70973113ab4a98454a5c5d7e3a26ae.patch";
-      revert = true;
-      sha256 = "VKXUwdS+zMp1y+5GrV2inESUpUUp+OL3aI4wOXHxOeo=";
-    })
-
     # Fix passing multiple --define-variable arguments to pkg-config.
     # https://github.com/mesonbuild/meson/pull/10670
     (fetchpatch {
diff --git a/pkgs/development/tools/build-managers/redo-apenwarr/default.nix b/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
index e8ea9a91f45e7..22841cb20d174 100644
--- a/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
+++ b/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, python3, fetchFromGitHub, which, coreutils
-, perl, installShellFiles
+, perl, installShellFiles, gnumake42
 , doCheck ? true
 }: stdenv.mkDerivation rec {
 
@@ -53,6 +53,7 @@
     (with python3.pkgs; [ beautifulsoup4 markdown ])
     which
     installShellFiles
+    gnumake42 # fails with make 4.4
   ];
 
   postInstall = ''
diff --git a/pkgs/development/tools/database/sqlfluff/default.nix b/pkgs/development/tools/database/sqlfluff/default.nix
index 340c471c27273..7015050e2d6f1 100644
--- a/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/pkgs/development/tools/database/sqlfluff/default.nix
@@ -31,8 +31,6 @@ python3.pkgs.buildPythonApplication rec {
     toml
     tqdm
     typing-extensions
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    dataclasses
   ] ++ lib.optionals (pythonOlder "3.8") [
     backports.cached-property
     importlib_metadata
diff --git a/pkgs/development/tools/dtools/default.nix b/pkgs/development/tools/dtools/default.nix
index 5faf403e71a66..f1d841828b3f6 100644
--- a/pkgs/development/tools/dtools/default.nix
+++ b/pkgs/development/tools/dtools/default.nix
@@ -1,4 +1,4 @@
-{stdenv, lib, fetchFromGitHub, fetchpatch, ldc, curl}:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, ldc, curl, gnumake42 }:
 
 stdenv.mkDerivation rec {
   pname = "dtools";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ ldc ];
+  nativeBuildInputs = [ ldc gnumake42 ]; # fails with make 4.4
   buildInputs = [ curl ];
 
   makeCmd = ''
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index c844dbffee404..30e0ce44ca4ae 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -26,34 +26,15 @@ with lib;
 stdenv.mkDerivation rec {
   pname = "cups";
 
-  # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.4.2";
+  version = "2.4.2";
 
-  src = fetchurl (if stdenv.isDarwin then {
-    url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20";
-  } else {
+  src = fetchurl {
     url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
     sha256 = "sha256-8DzLQLCH0eMJQKQOAUHcu6Jj85l0wg658lIQZsnGyQg=";
-  });
+  };
 
   outputs = [ "out" "lib" "dev" "man" ];
 
-  patches = lib.optionals (version == "2.2.6") [
-    ./0001-TargetConditionals.patch
-    (fetchpatch {
-      name = "CVE-2022-26691.patch";
-      url = "https://github.com/OpenPrinting/cups/commit/de4f8c196106033e4c372dce3e91b9d42b0b9444.patch";
-      sha256 = "sha256-IKOtV7bCS6PstwK6YqnYRYTeH562jWwkley86p+6Of8=";
-      excludes = [ "CHANGES.md" ];
-    })
-    (fetchpatch {
-      name = "CVE-2022-26691-fix-comment.patch";
-      url = "https://github.com/OpenPrinting/cups/commit/411b6136f450a583ee08c3880fa09dbe837eb3f1.patch";
-      sha256 = "sha256-dVopmr34c9N5H2ZZz52rXVnHQBuDTNo8M40x9455+jQ=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace cups/testfile.c \
       --replace 'cupsFileFind("cat", "/bin' 'cupsFileFind("cat", "${coreutils}/bin'
@@ -83,8 +64,7 @@ stdenv.mkDerivation rec {
   ] ++ optional (libusb1 != null) "--enable-libusb"
     ++ optional (gnutls != null) "--enable-ssl"
     ++ optional (avahi != null) "--enable-avahi"
-    ++ optional (libpaper != null) "--enable-libpaper"
-    ++ optional stdenv.isDarwin "--disable-launchd";
+    ++ optional (libpaper != null) "--enable-libpaper";
 
   # AR has to be an absolute path
   preConfigure = ''
@@ -108,6 +88,7 @@ stdenv.mkDerivation rec {
   installFlags =
     [ # Don't try to write in /var at build time.
       "CACHEDIR=$(TMPDIR)/dummy"
+      "LAUNCHD_DIR=$(TMPDIR)/dummy"
       "LOGDIR=$(TMPDIR)/dummy"
       "REQUESTS=$(TMPDIR)/dummy"
       "STATEDIR=$(TMPDIR)/dummy"
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index ff8fbb460b275..020aee04af79d 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , alsa-lib
 , dbus
 , ell
@@ -22,13 +23,21 @@
   ];
 in stdenv.mkDerivation rec {
   pname = "bluez";
-  version = "5.65";
+  version = "5.66";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-JWWk1INUtXbmrZLiW1TtZoCCllgciruAWHBR+Zk9ltQ=";
+    sha256 = "sha256-Of6mS1kMlJKYSgwnqJ/CA+HNx0hmCG77j0aYZ3qytXQ=";
   };
 
+  patches = [
+    # replace use of a non-standard symbol to fix build with musl libc (pkgsMusl.bluez)
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/main/bluez/max-input.patch?id=32b31b484cb13009bd8081c4106e4cf064ec2f1f";
+      sha256 = "sha256-SczbXtsxBkCO+izH8XOBcrJEO2f7MdtYVT3+2fCV8wU=";
+    })
+  ];
+
   buildInputs = [
     alsa-lib
     dbus
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 2fce9d6f0d7b5..1e188fbe60743 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.53";
+  version = "0.54";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-txtXPWmLfZLBsK3s94W5LyA81mTHStpP3nkq6KW33Mk=";
+    sha256 = "sha256-Oi+S4DWXuTUL36Xh3iWIZj9rdN2qUDHmZiFSH1csW+8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
index a5b2dabfd264c..ec3d0f880f840 100644
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchzip, autoreconfHook, pkg-config, glib, pcre
+{ lib, stdenv, fetchzip, autoreconfHook, pkg-config, gnumake42, glib, pcre
 , json_c, flex, bison, dtc, pciutils, dmidecode, acpica-tools, libbsd }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  # fails with make 4.4
+  nativeBuildInputs = [ autoreconfHook pkg-config gnumake42 ];
   buildInputs = [ glib pcre json_c flex bison dtc pciutils dmidecode acpica-tools libbsd ];
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index c121ef6f6f539..8fb826833704d 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.363";
+  version = "0.364";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "sha256-A6GNrHc/t2SVyAyJWmzQTa+pD9wGESsz7DNruW2kH4s=";
+    sha256 = "sha256-9fGYoyj7vN3j72H+6jv/R0MaWPZ+4UNQhCSWnZRZZS4=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index b62b6946e4259..b3895c286c564 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -12,12 +12,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "1.30";
+  version = "2.0";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "sha256-9uyYXxnxRqWvzrw3QXCOT/ZubQ8/nrB+b60jKn1hAJk=";
+    sha256 = "sha256-9eQ2fW3ha69ngugYonbYdqrpERqt8aM0Ed4HM0CrmUU=";
   };
 
   outputs = [ "out" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 1351008886a3e..5ac3a827f686c 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -523,6 +523,15 @@ let
       X86_SGX     = whenAtLeast "5.11" yes;
       # Allow KVM guests to load SGX enclaves
       X86_SGX_KVM = whenAtLeast "5.13" yes;
+
+      # AMD Cryptographic Coprocessor (CCP)
+      CRYPTO_DEV_CCP  = yes;
+      # AMD SME
+      AMD_MEM_ENCRYPT = yes;
+      # AMD SEV and AMD SEV-SE
+      KVM_AMD_SEV     = whenAtLeast "4.16" yes;
+      # AMD SEV-SNP
+      SEV_GUEST       = whenAtLeast "5.19" module;
     };
 
     microcode = {
diff --git a/pkgs/os-specific/windows/mingw-w64/default.nix b/pkgs/os-specific/windows/mingw-w64/default.nix
index 316907f5f6793..221bcd8e89f24 100644
--- a/pkgs/os-specific/windows/mingw-w64/default.nix
+++ b/pkgs/os-specific/windows/mingw-w64/default.nix
@@ -1,4 +1,10 @@
-{ lib, stdenv, windows, fetchurl }:
+{ lib
+, stdenv
+, windows
+, fetchurl
+, fetchpatch
+, autoreconfHook
+}:
 
 let
   version = "10.0.0";
@@ -11,6 +17,20 @@ in stdenv.mkDerivation {
     hash = "sha256-umtDCu1yxjo3aFMfaj/8Kw/eLFejslFFDc9ImolPCJQ=";
   };
 
+  patches = [
+    # Upstream patches to fix build parallelism
+    (fetchpatch {
+      name = "crt-suff-make-4.4.patch";
+      url = "https://github.com/mirror/mingw-w64/commit/953bcd32ae470c4647e94de8548dda5a8f07d82d.patch";
+      hash = "sha256-lrS4ZDa/Uwsj5DXajOUv+knZXan0JVU70KHHdIjJ07Y=";
+    })
+    (fetchpatch {
+      name = "dll-dep-make-4.4.patch";
+      url = "https://github.com/mirror/mingw-w64/commit/e1b0c1420bbd52ef505c71737c57393ac1397b0a.patch";
+      hash = "sha256-/56Cmmy0UYTaDKIWG7CgXsThvCHK6lSbekbBOoOJSIQ=";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
 
   configureFlags = [
@@ -20,6 +40,7 @@ in stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ windows.mingw_w64_headers ];
   hardeningDisable = [ "stackprotector" "fortify" ];
 
diff --git a/pkgs/servers/calibre-web/default.nix b/pkgs/servers/calibre-web/default.nix
index 6047eae3c962a..14c4822f3fb45 100644
--- a/pkgs/servers/calibre-web/default.nix
+++ b/pkgs/servers/calibre-web/default.nix
@@ -18,7 +18,6 @@ python3.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python3.pkgs; [
     APScheduler
     advocate
-    backports_abc
     chardet
     flask-babel
     flask-login
@@ -54,6 +53,8 @@ python3.pkgs.buildPythonApplication rec {
     mv cps.py src/calibreweb/__init__.py
     mv cps src/calibreweb
 
+    sed -i "/backports_abc/d" setup.cfg
+
     substituteInPlace setup.cfg \
       --replace "cps = calibreweb:main" "calibre-web = calibreweb:main" \
       --replace "chardet>=3.0.0,<4.1.0" "chardet>=3.0.0,<6" \
diff --git a/pkgs/shells/bash/5.1.nix b/pkgs/shells/bash/5.1.nix
index 0f50c72f5da0d..0dbfd77bf0e70 100644
--- a/pkgs/shells/bash/5.1.nix
+++ b/pkgs/shells/bash/5.1.nix
@@ -7,7 +7,7 @@
 
   # patch for cygwin requires readline support
 , interactive ? stdenv.isCygwin
-, readline81 ? null
+, readline ? null
 , withDocs ? false
 , texinfo ? null
 , forFHSEnv ? false
@@ -15,7 +15,7 @@
 
 with lib;
 
-assert interactive -> readline81 != null;
+assert interactive -> readline != null;
 assert withDocs -> texinfo != null;
 assert stdenv.hostPlatform.isDarwin -> binutils != null;
 let
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     ++ optional withDocs texinfo
     ++ optional stdenv.hostPlatform.isDarwin binutils;
 
-  buildInputs = optional interactive readline81;
+  buildInputs = optional interactive readline;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index c6ee509df3581..0a0838d676d9e 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -73,10 +73,10 @@ with py.pkgs; buildPythonApplication rec {
   ];
 
   postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "colorama>=0.2.5,<0.4.4" "colorama" \
-      --replace "distro>=1.5.0,<1.6.0" "distro" \
-      --replace "cryptography>=3.3.2,<=38.0.1" "cryptography>=3.3.2,<=38.0.3"
+    sed -i pyproject.toml \
+      -e 's/colorama.*/colorama",/' \
+      -e 's/cryptography.*/cryptography",/' \
+      -e 's/distro.*/distro",/'
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index 1f898dbdef4bc..abc19356c9501 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xz";
-  version = "5.2.7";
+  version = "5.2.9";
 
   src = fetchurl {
     url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "tl8dDCcI5XcW9N0iFpiac4R6xv20Fo/86xVXZ+Irg0s=";
+    sha256 = "sZRQf7o6Rip1PFUxSczaoWgze8t97v3dBnuph8g9/OY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/games/weidu/default.nix b/pkgs/tools/games/weidu/default.nix
index 0a144604b13dd..1464dfbbf869b 100644
--- a/pkgs/tools/games/weidu/default.nix
+++ b/pkgs/tools/games/weidu/default.nix
@@ -5,6 +5,7 @@
 , ocaml-ng
 , perl
 , which
+, gnumake42
 }:
 
 let
@@ -38,7 +39,7 @@ stdenv.mkDerivation rec {
     mkdir -p obj/{.depend,x86_LINUX}
   '';
 
-  nativeBuildInputs = [ elkhound ocaml' perl which ];
+  nativeBuildInputs = [ elkhound ocaml' perl which gnumake42 ];
 
   buildFlags = [ "weidu" "weinstall" "tolower" ];
 
diff --git a/pkgs/tools/misc/dateutils/default.nix b/pkgs/tools/misc/dateutils/default.nix
index ec8f9ca83d93e..a1b64442c0bcc 100644
--- a/pkgs/tools/misc/dateutils/default.nix
+++ b/pkgs/tools/misc/dateutils/default.nix
@@ -9,6 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-PFCOKIm51a7Kt9WdcyWnAIlZMRGhIwpJbasPWtZ3zew=";
   };
 
+  # https://github.com/hroptatyr/dateutils/issues/148
+  postPatch = "rm test/dzone.008.ctst";
+
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ tzdata ]; # needed for datezone
   enableParallelBuilding = true;
diff --git a/pkgs/tools/networking/netsniff-ng/default.nix b/pkgs/tools/networking/netsniff-ng/default.nix
index 36028208f56d5..a6bf4383b3178 100644
--- a/pkgs/tools/networking/netsniff-ng/default.nix
+++ b/pkgs/tools/networking/netsniff-ng/default.nix
@@ -15,6 +15,7 @@
 , liburcu
 , ncurses
 , pkg-config
+, gnumake42
 , zlib
 }:
 
@@ -34,6 +35,7 @@ stdenv.mkDerivation rec {
     flex
     makeWrapper
     pkg-config
+    gnumake42 # fails with make 4.4
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 3a2b2ef175e9c..03c205f2d647e 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -58,11 +58,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.40.2";
+  version = "1.40.6";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "sha256-sSbnWiNJNsmcR7JZxVEg692b92rE79MMmBHlagSBwnM=";
+    sha256 = "sha256-LwJbLVr33lk7v0fBfk2YorlgjqkKgmD7CAgL6XQ5U04=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index 9cc4941853d58..a07b46c3a3b95 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -1,4 +1,5 @@
 { lib, stdenv
+, gnumake42
 , darwin
 , fetchurl
 , makeWrapper
@@ -59,6 +60,7 @@ stdenv.mkDerivation rec {
     gitMinimal
     pkg-config
     makeWrapper
+    gnumake42
   ];
   buildInputs = [
     luaEnv
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index ed6a8f5423430..8a2d6f7444220 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -1,20 +1,33 @@
-{ lib, rust, stdenv, rustPlatform, fetchCrate, nasm, cargo-c, libiconv }:
+{ lib
+, rust
+, stdenv
+, rustPlatform
+, fetchCrate
+, nasm
+, cargo-c
+, libiconv
+, Security
+}:
 
 let
   rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
 in rustPlatform.buildRustPackage rec {
   pname = "rav1e";
-  version = "0.5.1";
+  version = "0.6.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-v2i/dMWos+nB3cRDOkROSOPb1ONRosbmp9RDZI2DLeI=";
+    sha256 = "sha256-70O9/QRADaEYVvZjEfuBOxPF8lCZ138L2fbFWpj3VUw=";
   };
 
-  cargoSha256 = "sha256-V9QbztkFj3t5yBV+yySysDy3Q6IUY4gNzBL8h23aEg4=";
+  cargoHash = "sha256-iHOmItooNsGq6iTIb9M5IPXMwYh2nQ03qfjomkgCdgw=";
 
   nativeBuildInputs = [ nasm cargo-c ];
-  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    libiconv
+    Security
+  ];
 
   checkType = "debug";
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 563f95233f6ef..d459d90fd2bca 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1302,7 +1302,7 @@ mapAliases ({
   rdmd = throw "'rdmd' has been renamed to/replaced by 'dtools'"; # Converted to throw 2022-02-22
   readline5 = throw "readline-5 is no longer supported in nixpkgs, please use 'readline' for main supported version"; # Added 2022-02-20
   readline62 = throw "readline-6.2 is no longer supported in nixpkgs, please use 'readline' for main supported version"; # Added 2022-02-20
-  readline80 = throw "readline-8.0 is no longer supported in nixpkgs, please use 'readline' for main supported version or 'readline81' for most recent version"; # Added 2021-04-22
+  readline80 = throw "readline-8.0 is no longer supported in nixpkgs, please use 'readline' for main supported version"; # Added 2021-04-22
   redkite = throw "redkite was archived by upstream"; # Added 2021-04-12
   redis-desktop-manager = throw "'redis-desktop-manager' has been renamed to/replaced by 'resp-app'"; # Added 2022-11-10
   redshift-wlr = throw "redshift-wlr has been replaced by gammastep"; # Added 2021-12-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2381736a3c08d..8c5f68c5d937c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5374,7 +5374,9 @@ with pkgs;
     rainloop-community
     rainloop-standard;
 
-  rav1e = callPackage ../tools/video/rav1e { };
+  rav1e = callPackage ../tools/video/rav1e {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   raven-reader = callPackage ../applications/networking/newsreaders/raven-reader { };
 
@@ -15490,7 +15492,8 @@ with pkgs;
   sbcl_2_2_6 = callPackage ../development/compilers/sbcl/2.x.nix { version = "2.2.6"; };
   sbcl_2_2_9 = callPackage ../development/compilers/sbcl/2.x.nix { version = "2.2.9"; };
   sbcl_2_2_10 = callPackage ../development/compilers/sbcl/2.x.nix { version = "2.2.10"; };
-  sbcl = sbcl_2_2_10;
+  sbcl_2_2_11 = callPackage ../development/compilers/sbcl/2.x.nix { version = "2.2.11"; };
+  sbcl = sbcl_2_2_11;
 
   roswell = callPackage ../development/tools/roswell { };
 
@@ -16107,7 +16110,7 @@ with pkgs;
   };
 
   pythonInterpreters = callPackage ./../development/interpreters/python { };
-  inherit (pythonInterpreters) python27 python37 python38 python39 python310 python311 python3Minimal pypy27 pypy39 pypy38 pypy37 rustpython;
+  inherit (pythonInterpreters) python27 python37 python38 python39 python310 python311 python312 python3Minimal pypy27 pypy39 pypy38 pypy37 rustpython;
 
   # List of extensions with overrides to apply to all Python package sets.
   pythonPackagesExtensions = [ ];
@@ -16118,6 +16121,7 @@ with pkgs;
   python39Packages = recurseIntoAttrs python39.pkgs;
   python310Packages = recurseIntoAttrs python310.pkgs;
   python311Packages = python311.pkgs;
+  python312Packages = python312.pkgs;
   pypyPackages = pypy.pkgs;
   pypy2Packages = pypy2.pkgs;
   pypy27Packages = pypy27.pkgs;
@@ -18219,7 +18223,6 @@ with pkgs;
 
   gdb = callPackage ../development/tools/misc/gdb {
     guile = null;
-    readline = readline81;
   };
 
   gf = callPackage ../development/tools/misc/gf { };
@@ -21069,9 +21072,7 @@ with pkgs;
     python = python3;
   };
 
-  libqalculate = callPackage ../development/libraries/libqalculate {
-    readline = readline81;
-  };
+  libqalculate = callPackage ../development/libraries/libqalculate { };
 
   libqt5pas = libsForQt5.callPackage ../development/compilers/fpc/libqt5pas.nix { };
 
@@ -22318,7 +22319,7 @@ with pkgs;
 
   raylib = callPackage ../development/libraries/raylib { };
 
-  readline = readline6;
+  readline = readline81;
   readline6 = readline63;
 
   readline63 = callPackage ../development/libraries/readline/6.3.nix { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 5db18622e7751..8223de074b811 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -191,6 +191,7 @@ mapAliases ({
   repeated_test = repeated-test; # added 2022-11-15
   requests_oauthlib = requests-oauthlib; # added 2022-02-12
   requests_toolbelt = requests-toolbelt; # added 2017-09-26
+  rig = throw "rig has been removed because it was pinned to python 2.7 and 3.5, failed to build and is otherwise unmaintained"; # added 2022-11-28
   roboschool = throw "roboschool is deprecated in favor of PyBullet and has been removed"; # added 2022-01-15
   ROPGadget = ropgadget; # added 2021-07-06
   rotate-backups = throw "rotate-backups was removed in favor of the top-level rotate-backups"; # added 2021-07-01
@@ -218,6 +219,7 @@ mapAliases ({
   tvnamer = throw "tvnamer was moved to pkgs.tvnamer"; # added 2021-07-05
   types-cryptography = throw "types-cryptography has been removed because it is obsolete since cryptography version 3.4.4."; # added 2022-05-30
   types-paramiko = throw "types-paramiko has been removed because it was unused."; # added 2022-05-30
+  unittest2 = throw "unittest2 has been removed as it's a backport of unittest that's unmaintained and not needed beyond Python 3.4."; # added 2022-12-01
   uproot3 = throw "uproot3 has been removed, use uproot instead"; # added 2022-12-13
   uproot3-methods = throw "uproot3-methods has been removed"; # added 2022-12-13
   Wand = wand; # added 2022-11-13
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4c1c8fde82184..127bee350da6f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1107,8 +1107,6 @@ self: super: with self; {
 
   backports-cached-property = callPackage ../development/python-modules/backports-cached-property { };
 
-  backports_abc = callPackage ../development/python-modules/backports_abc { };
-
   backports_csv = callPackage ../development/python-modules/backports_csv { };
 
   backports-datetime-fromisoformat = callPackage ../development/python-modules/backports-datetime-fromisoformat { };
@@ -1121,8 +1119,6 @@ self: super: with self; {
 
   backports-shutil-which = callPackage ../development/python-modules/backports-shutil-which { };
 
-  backports_ssl_match_hostname = callPackage ../development/python-modules/backports_ssl_match_hostname { };
-
   backports_tempfile = callPackage ../development/python-modules/backports_tempfile { };
 
   backports_unittest-mock = callPackage ../development/python-modules/backports_unittest-mock { };
@@ -1973,8 +1969,6 @@ self: super: with self; {
 
   contextlib2 = callPackage ../development/python-modules/contextlib2 { };
 
-  contextvars = callPackage ../development/python-modules/contextvars { };
-
   contexttimer = callPackage ../development/python-modules/contexttimer { };
 
   convertdate = callPackage ../development/python-modules/convertdate { };
@@ -2195,8 +2189,6 @@ self: super: with self; {
 
   databricks-sql-connector = callPackage ../development/python-modules/databricks-sql-connector { };
 
-  dataclasses = callPackage ../development/python-modules/dataclasses { };
-
   dataclasses-json = callPackage ../development/python-modules/dataclasses-json { };
 
   dataclasses-serialization = callPackage ../development/python-modules/dataclasses-serialization { };
@@ -2864,8 +2856,6 @@ self: super: with self; {
 
   EasyProcess = callPackage ../development/python-modules/easyprocess { };
 
-  easysnmp = callPackage ../development/python-modules/easysnmp { };
-
   easy-thumbnails = callPackage ../development/python-modules/easy-thumbnails { };
 
   easywatch = callPackage ../development/python-modules/easywatch { };
@@ -6906,6 +6896,8 @@ self: super: with self; {
 
   msgraph-core = callPackage ../development/python-modules/msgraph-core { };
 
+  multipart = callPackage ../development/python-modules/multipart { };
+
   netmap = callPackage ../development/python-modules/netmap { };
 
   onetimepad = callPackage ../development/python-modules/onetimepad { };
@@ -9841,8 +9833,6 @@ self: super: with self; {
 
   rich-rst = callPackage ../development/python-modules/rich-rst { };
 
-  rig = callPackage ../development/python-modules/rig { };
-
   ring-doorbell = callPackage ../development/python-modules/ring-doorbell { };
 
   ripe-atlas-cousteau = callPackage ../development/python-modules/ripe-atlas-cousteau { };
@@ -11646,8 +11636,6 @@ self: super: with self; {
 
   units = callPackage ../development/python-modules/units { };
 
-  unittest2 = callPackage ../development/python-modules/unittest2 { };
-
   unittest-data-provider = callPackage ../development/python-modules/unittest-data-provider { };
 
   unittest-xml-reporting = callPackage ../development/python-modules/unittest-xml-reporting { };
diff --git a/pkgs/top-level/python2-packages.nix b/pkgs/top-level/python2-packages.nix
index e3750544d3edf..00d28e73854f6 100644
--- a/pkgs/top-level/python2-packages.nix
+++ b/pkgs/top-level/python2-packages.nix
@@ -9,6 +9,8 @@ with self; with super; {
 
   bootstrapped-pip = toPythonModule (callPackage ../development/python2-modules/bootstrapped-pip { });
 
+  cffi = callPackage ../development/python2-modules/cffi { inherit cffi; };
+
   configparser = callPackage ../development/python2-modules/configparser { };
 
   contextlib2 = callPackage ../development/python2-modules/contextlib2 { };