diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 173f125bd577e..825b1c5bd407a 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -211,6 +211,18 @@ The module update takes care of the new config syntax and the data itself (user
 
 - The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and similar lines in package derivations using the default `unpackPhase` is deprecated as it requires `unpackPhase` to always produce a directory named "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`, or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead.
 
+- The `django` alias in the python package set was upgraded to Django 4.x.
+  Applications that consume Django should always pin their python environment
+  to a compatible major version, so they can move at their own pace.
+
+  ```nix
+  python = python3.override {
+    packageOverrides = self: super: {
+      django = super.django_3;
+    };
+  };
+  ```
+
 - The `qemu-vm.nix` module by default now identifies block devices via
   persistent names available in `/dev/disk/by-*`. Because the rootDevice is
   identfied by its filesystem label, it needs to be formatted before the VM is
diff --git a/nixos/modules/virtualisation/docker.nix b/nixos/modules/virtualisation/docker.nix
index 20f47a76c87b9..6fe460316091b 100644
--- a/nixos/modules/virtualisation/docker.nix
+++ b/nixos/modules/virtualisation/docker.nix
@@ -236,8 +236,8 @@ in
       };
 
       assertions = [
-        { assertion = cfg.enableNvidia -> config.hardware.opengl.driSupport32Bit or false;
-          message = "Option enableNvidia requires 32bit support libraries";
+        { assertion = cfg.enableNvidia && pkgs.stdenv.isx86_64 -> config.hardware.opengl.driSupport32Bit or false;
+          message = "Option enableNvidia on x86_64 requires 32bit support libraries";
         }];
 
       virtualisation.docker.daemon.settings = {
diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index af6c8f7c6f8d5..c1f99de71057c 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -1,42 +1,14 @@
-{ lib, stdenv, fetchurl, lzip }:
-
-# Note: this package is used for bootstrapping fetchurl, and thus
-# cannot use fetchpatch! All mutable patches (generated by GitHub or
-# cgit) that are needed here should be included directly in Nixpkgs as
-# files.
-
-stdenv.mkDerivation rec {
-  pname = "ed";
-  version = "1.19";
-
-  src = fetchurl {
-    url = "mirror://gnu/ed/${pname}-${version}.tar.lz";
-    hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
-  };
-
-  nativeBuildInputs = [ lzip ];
-
-  configureFlags = [
-    "CC=${stdenv.cc.targetPrefix}cc"
-  ];
-
-  doCheck = true;
-
-  meta = {
-    description = "An implementation of the standard Unix editor";
-    longDescription = ''
-      GNU ed is a line-oriented text editor.  It is used to create,
-      display, modify and otherwise manipulate text files, both
-      interactively and via shell scripts.  A restricted version of ed,
-      red, can only edit files in the current directory and cannot
-      execute shell commands.  Ed is the "standard" text editor in the
-      sense that it is the original editor for Unix, and thus widely
-      available.  For most purposes, however, it is superseded by
-      full-screen editors such as GNU Emacs or GNU Moe.
-    '';
-    license = lib.licenses.gpl3Plus;
-    homepage = "https://www.gnu.org/software/ed/";
-    maintainers = [ ];
-    platforms = lib.platforms.unix;
-  };
-}
+{ lib, pkgs }:
+
+lib.makeScope pkgs.newScope (self:
+  let
+    inherit (self) callPackage;
+  in {
+    sources = import ./sources.nix {
+      inherit lib;
+      inherit (pkgs) fetchurl;
+    };
+
+    ed = callPackage (self.sources.ed) { };
+    edUnstable = callPackage (self.sources.edUnstable) { };
+  })
diff --git a/pkgs/applications/editors/ed/generic.nix b/pkgs/applications/editors/ed/generic.nix
new file mode 100644
index 0000000000000..70ec6badf25ec
--- /dev/null
+++ b/pkgs/applications/editors/ed/generic.nix
@@ -0,0 +1,30 @@
+{ pname
+, version
+, src
+, patches ? [ ]
+, meta
+}:
+
+# Note: this package is used for bootstrapping fetchurl, and thus cannot use
+# fetchpatch! All mutable patches (generated by GitHub or cgit) that are needed
+# here should be included directly in Nixpkgs as files.
+
+{ lib
+, stdenv
+, fetchurl
+, lzip
+}:
+
+stdenv.mkDerivation {
+  inherit pname version src patches;
+
+  nativeBuildInputs = [ lzip ];
+
+  configureFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  doCheck = true;
+
+  inherit meta;
+}
diff --git a/pkgs/applications/editors/ed/sources.nix b/pkgs/applications/editors/ed/sources.nix
new file mode 100644
index 0000000000000..5cb7501830532
--- /dev/null
+++ b/pkgs/applications/editors/ed/sources.nix
@@ -0,0 +1,45 @@
+{ lib
+, fetchurl
+}:
+
+let
+  meta = {
+    description = "The GNU implementation of the standard Unix editor";
+    longDescription = ''
+      GNU ed is a line-oriented text editor. It is used to create, display,
+      modify and otherwise manipulate text files, both interactively and via
+      shell scripts. A restricted version of ed, red, can only edit files in the
+      current directory and cannot execute shell commands. Ed is the 'standard'
+      text editor in the sense that it is the original editor for Unix, and thus
+      widely available. For most purposes, however, it is superseded by
+      full-screen editors such as GNU Emacs or GNU Moe.
+    '';
+    license = lib.licenses.gpl3Plus;
+    homepage = "https://www.gnu.org/software/ed/";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+in
+{
+  ed = let
+    pname = "ed";
+    version = "1.19";
+    src = fetchurl {
+      url = "mirror://gnu/ed/ed-${version}.tar.lz";
+      hash = "sha256-zi8uXEJHkKqW0J2suT2bv9wLfrYknJy3U4RS6Ox3zUg=";
+    };
+  in import ./generic.nix {
+    inherit pname version src meta;
+  };
+
+  edUnstable = let
+    pname = "ed";
+    version = "1.20-pre2";
+    src = fetchurl {
+      url = "http://download.savannah.gnu.org/releases/ed/ed-${version}.tar.lz";
+      hash = "sha256-bHTDeMhVNNo3qqDNoBNaBA+DHDa4WJpfQNcTvAUPgsY=";
+    };
+  in import ./generic.nix {
+    inherit pname version src meta;
+  };
+}
diff --git a/pkgs/applications/kde/marble.nix b/pkgs/applications/kde/marble.nix
index 7fe3aa529fa24..f36d91df5978a 100644
--- a/pkgs/applications/kde/marble.nix
+++ b/pkgs/applications/kde/marble.nix
@@ -2,7 +2,7 @@
 , extra-cmake-modules, kdoctools
 , qtscript, qtsvg, qtquickcontrols, qtwebengine
 , krunner, shared-mime-info, kparts, knewstuff
-, gpsd, perl
+, gpsd, perl, protobuf3_21
 }:
 
 mkDerivation {
@@ -15,7 +15,7 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools perl ];
   propagatedBuildInputs = [
-    qtscript qtsvg qtquickcontrols qtwebengine shared-mime-info krunner kparts
+    protobuf3_21 qtscript qtsvg qtquickcontrols qtwebengine shared-mime-info krunner kparts
     knewstuff gpsd
   ];
   preConfigure = ''
diff --git a/pkgs/applications/misc/djvulibre/c++17-register-class.patch b/pkgs/applications/misc/djvulibre/c++17-register-class.patch
new file mode 100644
index 0000000000000..88251b34f7732
--- /dev/null
+++ b/pkgs/applications/misc/djvulibre/c++17-register-class.patch
@@ -0,0 +1,21 @@
+diff -ur a/libdjvu/GBitmap.h b/libdjvu/GBitmap.h
+--- a/libdjvu/GBitmap.h	2020-11-20 09:57:32.000000000 -0700
++++ b/libdjvu/GBitmap.h	2023-07-07 07:07:45.519912414 -0600
+@@ -620,7 +620,7 @@
+ inline int
+ GBitmap::read_run(unsigned char *&data)
+ {
+-  register int z=*data++;
++  int z=*data++;
+   return (z>=RUNOVERFLOWVALUE)?
+     ((z&~RUNOVERFLOWVALUE)<<8)|(*data++):z;
+ }
+@@ -628,7 +628,7 @@
+ inline int
+ GBitmap::read_run(const unsigned char *&data)
+ {
+-  register int z=*data++;
++  int z=*data++;
+   return (z>=RUNOVERFLOWVALUE)?
+     ((z&~RUNOVERFLOWVALUE)<<8)|(*data++):z;
+ }
diff --git a/pkgs/applications/misc/djvulibre/default.nix b/pkgs/applications/misc/djvulibre/default.nix
index ad85c9c79d1d2..65591c8d82545 100644
--- a/pkgs/applications/misc/djvulibre/default.nix
+++ b/pkgs/applications/misc/djvulibre/default.nix
@@ -30,6 +30,10 @@ stdenv.mkDerivation rec {
     bash
   ];
 
+  # Remove uses of the `register` storage class specifier, which was removed in C++17.
+  # Fixes compilation with clang 16, which defaults to C++17.
+  patches = [ ./c++17-register-class.patch ];
+
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/ola/default.nix b/pkgs/applications/misc/ola/default.nix
index 14055463fa3f1..b016aa8719c70 100644
--- a/pkgs/applications/misc/ola/default.nix
+++ b/pkgs/applications/misc/ola/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     python3
   ];
   propagatedBuildInputs = [
-    python3.pkgs.protobuf
+    (python3.pkgs.protobuf.override { protobuf = protobuf; })
     python3.pkgs.numpy
   ];
 
diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix
index 3bfe95c090828..b05d6d482a2af 100644
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@@ -9,6 +9,8 @@ let
 
   python3' = python310.override {
     packageOverrides = self: super: {
+      django = super.django_3;
+
       sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
         version = "1.3.24";
         src = fetchPypi {
diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index fdc649bd0b2ca..27fdde3c2a660 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -7,7 +7,6 @@
 , flac
 , libogg
 , libvorbis
-, grpcSupport ? false, grpc, which
 , iceSupport ? true, zeroc-ice
 , jackSupport ? false, libjack2
 , pipewireSupport ? true, pipewire
@@ -100,12 +99,10 @@ let
         "-D Ice_HOME=${lib.getDev zeroc-ice};${lib.getLib zeroc-ice}"
         "-D CMAKE_PREFIX_PATH=${lib.getDev zeroc-ice};${lib.getLib zeroc-ice}"
         "-D Ice_SLICE_DIR=${lib.getDev zeroc-ice}/share/ice/slice"
-      ]
-      ++ lib.optional grpcSupport "-D grpc=ON";
+      ];
 
     buildInputs = [ libcap ]
-      ++ lib.optional iceSupport zeroc-ice
-      ++ lib.optionals grpcSupport [ grpc which ];
+      ++ lib.optional iceSupport zeroc-ice;
   } source;
 
   source = rec {
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 258bc5d71ddc6..f347ed884eff5 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -21,11 +21,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.5";
+    version = "6.5.1";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-pWA9DTlev2f+XSeruzvTf8wBhx7POUx5NnLSweaL5+c=";
+      sha256 = "sha256-M/fejYs2B/orQIzeS4cl4RfrCtQZJqeH6qtAnKik/C8=";
     };
 
     format = "other";
@@ -35,7 +35,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-umjOU3OmTdPmLS4IWncqmKxSa6J4KXwTlGhylFt6TQo=";
+      sha256 = "sha256-tPv0UeZOsHDGKzXWeA/fFio7d3EN+KGioDu/1WH1drc=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 5350fc3cc9ae5..244a0bb6623b8 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -246,10 +246,13 @@ if [[ -e @out@/nix-support/cc-wrapper-hook ]]; then
 fi
 
 if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
-    exec @prog@ @<(printf "%q\n" \
+    responseFile=$(mktemp --tmpdir cc-params.XXXXXX)
+    trap 'rm -f -- "$responseFile"' EXIT
+    printf "%q\n" \
        ${extraBefore+"${extraBefore[@]}"} \
        ${params+"${params[@]}"} \
-       ${extraAfter+"${extraAfter[@]}"})
+       ${extraAfter+"${extraAfter[@]}"} > "$responseFile"
+    @prog@ "@$responseFile"
 else
     exec @prog@ \
        ${extraBefore+"${extraBefore[@]}"} \
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index cc0aa784e2867..c7c733a427aa6 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -51,6 +51,8 @@
 
 # the derivation at which the `-B` and `-L` flags added by `useCcForLibs` will point
 , gccForLibs ? if useCcForLibs then cc else null
+, fortify-headers ? null
+, includeFortifyHeaders ? null
 }:
 
 with lib;
@@ -65,6 +67,10 @@ let
   stdenv = stdenvNoCC;
   inherit (stdenv) hostPlatform targetPlatform;
 
+  includeFortifyHeaders' = if includeFortifyHeaders != null
+    then includeFortifyHeaders
+    else targetPlatform.libc == "musl";
+
   # Prefix for binaries. Customarily ends with a dash separator.
   #
   # TODO(@Ericson2314) Make unconditional, or optional but always true by
@@ -165,6 +171,8 @@ let
     stdenv.targetPlatform.darwinMinVersionVariable;
 in
 
+assert includeFortifyHeaders' -> fortify-headers != null;
+
 # Ensure bintools matches
 assert libc_bin == bintools.libc_bin;
 assert libc_dev == bintools.libc_dev;
@@ -414,6 +422,16 @@ stdenv.mkDerivation {
 
       echo "${libc_lib}" > $out/nix-support/orig-libc
       echo "${libc_dev}" > $out/nix-support/orig-libc-dev
+    ''
+    # fortify-headers is a set of wrapper headers that augment libc
+    # and use #include_next to pass through to libc's true
+    # implementations, so must appear before them in search order.
+    # in theory a correctly placed -idirafter could be used, but in
+    # practice the compiler may have been built with a --with-headers
+    # like option that forces the libc headers before all -idirafter,
+    # hence -isystem here.
+    + optionalString includeFortifyHeaders' ''
+      echo "-isystem ${fortify-headers}/include" >> $out/nix-support/libc-cflags
     '')
 
     ##
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 6c2284a7a98de..586af56bd98f8 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -52,6 +52,9 @@ assert (args' ? vendorHash && args' ? vendorSha256) -> throw "both `vendorHash`
 let
   args = removeAttrs args' [ "overrideModAttrs" "vendorSha256" "vendorHash" ];
 
+  GO111MODULE = "on";
+  GOTOOLCHAIN = "local";
+
   goModules = if (vendorHash == null) then "" else
   (stdenv.mkDerivation {
     name = "${name}-go-modules";
@@ -60,6 +63,7 @@ let
 
     inherit (args) src;
     inherit (go) GOOS GOARCH;
+    inherit GO111MODULE GOTOOLCHAIN;
 
     # The following inheritence behavior is not trivial to expect, and some may
     # argue it's not ideal. Changing it may break vendor hashes in Nixpkgs and
@@ -73,8 +77,6 @@ let
     postBuild = args.modPostBuild or "";
     sourceRoot = args.sourceRoot or "";
 
-    GO111MODULE = "on";
-
     impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
       "GIT_PROXY_COMMAND"
       "SOCKS_SERVER"
@@ -85,6 +87,9 @@ let
       runHook preConfigure
       export GOCACHE=$TMPDIR/go-cache
       export GOPATH="$TMPDIR/go"
+      # fixes 'GOPROXY list is not the empty string, but contains no entries'
+      # "https://proxy.golang.org,direct" is the go default
+      export GOPROXY="''${GOPROXY:-"https://proxy.golang.org,direct"}" # respect impureEnvVars
       cd "${modRoot}"
       runHook postConfigure
     '';
@@ -149,9 +154,8 @@ let
 
     inherit (go) GOOS GOARCH;
 
-    GO111MODULE = "on";
     GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
-    inherit CGO_ENABLED enableParallelBuilding;
+    inherit CGO_ENABLED enableParallelBuilding GO111MODULE GOTOOLCHAIN;
 
     configurePhase = args.configurePhase or (''
       runHook preConfigure
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index b4cb264d9f242..7e099b76f0b76 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -86,6 +86,7 @@ let
     inherit CGO_ENABLED enableParallelBuilding;
 
     GO111MODULE = "off";
+    GOTOOLCHAIN = "local";
     GOFLAGS = lib.optionals (!allowGoReference) [ "-trimpath" ];
 
     GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
index 17b97b1082e93..62ba3705be20d 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@@ -1,5 +1,4 @@
-{ stdenv
-, targetPackages
+{ targetPackages
 , lib
 , makeSetupHook
 , dieHook
@@ -11,9 +10,7 @@
 
 makeSetupHook {
   name = "make-binary-wrapper-hook";
-  propagatedBuildInputs = [ dieHook ]
-    # https://github.com/NixOS/nixpkgs/issues/148189
-    ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) cc;
+  propagatedBuildInputs = [ dieHook ];
 
   substitutions = {
     cc = "${cc}/bin/${cc.targetPrefix}cc ${lib.escapeShellArgs (map (s: "-fsanitize=${s}") sanitizers)}";
diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
index 9a48440debec3..e6872db1acd70 100644
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -11,11 +11,12 @@ fixupOutputHooks+=(patchShebangsAuto)
 
 # Run patch shebangs on a directory or file.
 # Can take multiple paths as arguments.
-# patchShebangs [--build | --host] PATH...
+# patchShebangs [--build | --host | --update] [--] PATH...
 
 # Flags:
 # --build : Lookup commands available at build-time
 # --host  : Lookup commands available at runtime
+# --update : Update shebang paths that are in Nix store
 
 # Example use cases,
 # $ patchShebangs --host /nix/store/...-hello-1.0/bin
@@ -23,14 +24,35 @@ fixupOutputHooks+=(patchShebangsAuto)
 
 patchShebangs() {
     local pathName
-
-    if [[ "$1" == "--host" ]]; then
-        pathName=HOST_PATH
-        shift
-    elif [[ "$1" == "--build" ]]; then
-        pathName=PATH
-        shift
-    fi
+    local update
+
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+        --host)
+            pathName=HOST_PATH
+            shift
+            ;;
+        --build)
+            pathName=PATH
+            shift
+            ;;
+        --update)
+            update=true
+            shift
+            ;;
+        --)
+            shift
+            break
+            ;;
+        -*|--*)
+            echo "Unknown option $1 supplied to patchShebangs" >&2
+            return 1
+            ;;
+        *)
+            break
+            ;;
+        esac
+    done
 
     echo "patching script interpreter paths in $@"
     local f
@@ -93,7 +115,7 @@ patchShebangs() {
         newInterpreterLine="$newPath $args"
         newInterpreterLine=${newInterpreterLine%${newInterpreterLine##*[![:space:]]}}
 
-        if [[ -n "$oldPath" && "${oldPath:0:${#NIX_STORE}}" != "$NIX_STORE" ]]; then
+        if [[ -n "$oldPath" && ( "$update" == true || "${oldPath:0:${#NIX_STORE}}" != "$NIX_STORE" ) ]]; then
             if [[ -n "$newPath" && "$newPath" != "$oldPath" ]]; then
                 echo "$f: interpreter directive changed from \"$oldInterpreterLine\" to \"$newInterpreterLine\""
                 # escape the escape chars so that sed doesn't interpret them
diff --git a/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh b/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh
deleted file mode 100644
index 5f53e7e95b2ef..0000000000000
--- a/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh
+++ /dev/null
@@ -1,90 +0,0 @@
-# This setup hook strips libraries and executables in the fixup phase.
-
-fixupOutputHooks+=(_doStrip)
-
-_doStrip() {
-    # We don't bother to strip build platform code because it shouldn't make it
-    # to $out anyways---if it does, that's a bigger problem that a lack of
-    # stripping will help catch.
-    local -ra flags=(dontStripHost dontStripTarget)
-    local -ra debugDirs=(stripDebugList stripDebugListTarget)
-    local -ra allDirs=(stripAllList stripAllListTarget)
-    local -ra stripCmds=(STRIP STRIP_FOR_TARGET)
-    local -ra ranlibCmds=(RANLIB RANLIB_FOR_TARGET)
-
-    # TODO(structured-attrs): This doesn't work correctly if one of
-    #   the items in strip*List or strip*Flags contains a space,
-    #   even with structured attrs enabled.  This is OK for now
-    #   because very few packages set any of these, and it doesn't
-    #   affect any of them.
-    #
-    #   After __structuredAttrs = true is universal, come back and
-    #   push arrays all the way through this logic.
-
-    # Strip only host paths by default. Leave targets as is.
-    stripDebugList=${stripDebugList[*]:-lib lib32 lib64 libexec bin sbin}
-    stripDebugListTarget=${stripDebugListTarget[*]:-}
-    stripAllList=${stripAllList[*]:-}
-    stripAllListTarget=${stripAllListTarget[*]:-}
-
-    local i
-    for i in ${!stripCmds[@]}; do
-        local -n flag="${flags[$i]}"
-        local -n debugDirList="${debugDirs[$i]}"
-        local -n allDirList="${allDirs[$i]}"
-        local -n stripCmd="${stripCmds[$i]}"
-        local -n ranlibCmd="${ranlibCmds[$i]}"
-
-        # `dontStrip` disables them all
-        if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null 1>&2
-        then continue; fi
-
-        stripDirs "$stripCmd" "$ranlibCmd" "$debugDirList" "${stripDebugFlags[*]:--S -p}"
-        stripDirs "$stripCmd" "$ranlibCmd" "$allDirList" "${stripAllFlags[*]:--s -p}"
-    done
-}
-
-stripDirs() {
-    local cmd="$1"
-    local ranlibCmd="$2"
-    local paths="$3"
-    local stripFlags="$4"
-    local pathsNew=
-
-    [ -z "$cmd" ] && echo "stripDirs: Strip command is empty" 1>&2 && exit 1
-    [ -z "$ranlibCmd" ] && echo "stripDirs: Ranlib command is empty" 1>&2 && exit 1
-
-    local p
-    for p in ${paths}; do
-        if [ -e "$prefix/$p" ]; then
-            pathsNew="${pathsNew} $prefix/$p"
-        fi
-    done
-    paths=${pathsNew}
-
-    if [ -n "${paths}" ]; then
-        echo "stripping (with command $cmd and flags $stripFlags) in $paths"
-        local striperr
-        striperr="$(mktemp 'striperr.XXXXXX')"
-        # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
-        find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
-            # Make sure we process files under symlinks only once. Otherwise
-            # 'strip` can corrupt files when writes to them in parallel:
-            #   https://github.com/NixOS/nixpkgs/issues/246147#issuecomment-1657072039
-            xargs -r -0 -n1 -- realpath -z | sort -u -z |
-
-            xargs -r -0 -n1 -P "$NIX_BUILD_CORES" -- $cmd $stripFlags 2>"$striperr" || exit_code=$?
-        # xargs exits with status code 123 if some but not all of the
-        # processes fail. We don't care if some of the files couldn't
-        # be stripped, so ignore specifically this code.
-        [[ "$exit_code" = 123 || -z "$exit_code" ]] || (cat "$striperr" 1>&2 && exit 1)
-
-        rm "$striperr"
-        # 'strip' does not normally preserve archive index in .a files.
-        # This usually causes linking failures against static libs like:
-        #   ld: ...-i686-w64-mingw32-stage-final-gcc-13.0.0-lib/i686-w64-mingw32/lib/libstdc++.dll.a:
-        #     error adding symbols: archive has no index; run ranlib to add one
-        # Restore the index by running 'ranlib'.
-        find $paths -name '*.a' -type f -exec $ranlibCmd '{}' \; 2>/dev/null
-    fi
-}
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index 1d65c10c52308..d2422bb84234f 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -65,9 +65,14 @@ stripDirs() {
     if [ -n "${paths}" ]; then
         echo "stripping (with command $cmd and flags $stripFlags) in $paths"
         local striperr
-        striperr="$(mktemp 'striperr.XXXXXX')"
+        striperr="$(mktemp --tmpdir="$TMPDIR" 'striperr.XXXXXX')"
         # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
         find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
+            # Make sure we process files under symlinks only once. Otherwise
+            # 'strip` can corrupt files when writes to them in parallel:
+            #   https://github.com/NixOS/nixpkgs/issues/246147#issuecomment-1657072039
+            xargs -r -0 -n1 -- realpath -z | sort -u -z |
+
             xargs -r -0 -n1 -P "$NIX_BUILD_CORES" -- $cmd $stripFlags 2>"$striperr" || exit_code=$?
         # xargs exits with status code 123 if some but not all of the
         # processes fail. We don't care if some of the files couldn't
diff --git a/pkgs/build-support/writers/scripts.nix b/pkgs/build-support/writers/scripts.nix
index c43f10f0a2ec8..184ecee687770 100644
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@@ -92,12 +92,7 @@ rec {
       passAsFile = [ "content" ];
     } else {
       contentPath = content;
-    }) // lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) {
-      # post-link-hook expects codesign_allocate to be in PATH
-      # https://github.com/NixOS/nixpkgs/issues/154203
-      # https://github.com/NixOS/nixpkgs/issues/148189
-      nativeBuildInputs = [ stdenv.cc.bintools ];
-    } // lib.optionalAttrs (nameOrPath == "/bin/${name}") {
+    }) // lib.optionalAttrs (nameOrPath == "/bin/${name}") {
       meta.mainProgram = name;
     }) ''
       ${compileScript}
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index ff473019de775..0ab4819107f91 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -48,17 +48,16 @@ with lib;
 with builtins;
 
 let majorVersion = "10";
-    version = "${majorVersion}.4.0";
+    version = "${majorVersion}.5.0";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
     patches = [
       # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
       ../fix-bug-80431.patch
-      ../11/fix-struct-redefinition-on-glibc-2.36.patch
     ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
-      ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv.patch
+      ++ optional noSysDirs ../no-sys-dirs-riscv.patch
       /* ++ optional (hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
         url = "https://git.busybox.net/buildroot/plain/package/gcc/${version}/0900-remove-selftests.patch?id=11271540bfe6adafbc133caf6b5b902a816f5f02";
         sha256 = ""; # TODO: uncomment and check hash when available.
@@ -150,7 +149,7 @@ lib.pipe ((callFile ../common/builder.nix {}) ({
 
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "1wg4xdizkksmwi66mvv2v4pk3ja8x64m7v9gzhykzd3wrmdpsaf9";
+    hash = "sha256-JRCVQ/30bzl8NHtdi3osflaUpaUczkucbh6opxyjB8E=";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/gcc/11/fix-struct-redefinition-on-glibc-2.36.patch b/pkgs/development/compilers/gcc/11/fix-struct-redefinition-on-glibc-2.36.patch
deleted file mode 100644
index 3f5f64a3d0748..0000000000000
--- a/pkgs/development/compilers/gcc/11/fix-struct-redefinition-on-glibc-2.36.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From d2356ebb0084a0d80dbfe33040c9afe938c15d19 Mon Sep 17 00:00:00 2001
-From: Martin Liska <mliska@suse.cz>
-Date: Mon, 11 Jul 2022 22:03:14 +0200
-Subject: [PATCH] libsanitizer: cherry-pick 9cf13067cb5088626ba7 from upstream
-
-9cf13067cb5088626ba7ee1ec4c42ec59c7995a0 [sanitizer] Remove #include <linux/fs.h> to resolve fsconfig_command/mount_attr conflict with glibc 2.36
-
-(cherry picked from commit 2701442d0cf6292f6624443c15813d6d1a3562fe)
----
- .../sanitizer_platform_limits_posix.cpp                | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
-index 025e575b5bc7..5743516c0460 100644
---- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
-+++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
-@@ -72,7 +72,9 @@
- #include <sys/vt.h>
- #include <linux/cdrom.h>
- #include <linux/fd.h>
-+#if SANITIZER_ANDROID
- #include <linux/fs.h>
-+#endif
- #include <linux/hdreg.h>
- #include <linux/input.h>
- #include <linux/ioctl.h>
-@@ -828,10 +830,10 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
-   unsigned IOCTL_EVIOCGPROP = IOCTL_NOT_PRESENT;
-   unsigned IOCTL_EVIOCSKEYCODE_V2 = IOCTL_NOT_PRESENT;
- #endif
--  unsigned IOCTL_FS_IOC_GETFLAGS = FS_IOC_GETFLAGS;
--  unsigned IOCTL_FS_IOC_GETVERSION = FS_IOC_GETVERSION;
--  unsigned IOCTL_FS_IOC_SETFLAGS = FS_IOC_SETFLAGS;
--  unsigned IOCTL_FS_IOC_SETVERSION = FS_IOC_SETVERSION;
-+  unsigned IOCTL_FS_IOC_GETFLAGS = _IOR('f', 1, long);
-+  unsigned IOCTL_FS_IOC_GETVERSION = _IOR('v', 1, long);
-+  unsigned IOCTL_FS_IOC_SETFLAGS = _IOW('f', 2, long);
-+  unsigned IOCTL_FS_IOC_SETVERSION = _IOW('v', 2, long);
-   unsigned IOCTL_GIO_CMAP = GIO_CMAP;
-   unsigned IOCTL_GIO_FONT = GIO_FONT;
-   unsigned IOCTL_GIO_UNIMAP = GIO_UNIMAP;
diff --git a/pkgs/development/compilers/gcc/13/default.nix b/pkgs/development/compilers/gcc/13/default.nix
index 82b30a0e5102d..03d8e394ed6ae 100644
--- a/pkgs/development/compilers/gcc/13/default.nix
+++ b/pkgs/development/compilers/gcc/13/default.nix
@@ -55,7 +55,7 @@ with lib;
 with builtins;
 
 let majorVersion = "13";
-    version = "${majorVersion}.1.0";
+    version = "${majorVersion}.2.0";
     disableBootstrap = !stdenv.hostPlatform.isDarwin && !profiledCompiler;
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@@ -63,7 +63,7 @@ let majorVersion = "13";
     patches =
          optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../gcc-12-no-sys-dirs.patch
-      ++ optional noSysDirs ../no-sys-dirs-riscv.patch
+      ++ optional noSysDirs ./no-sys-dirs-riscv.patch
       ++ [
         ../gnat-cflags-11.patch
         ../gcc-12-gfortran-driving.patch
@@ -73,8 +73,8 @@ let majorVersion = "13";
       # a foreign one: https://github.com/iains/gcc-12-branch/issues/18
       ++ optional (stdenv.isDarwin && stdenv.isAarch64 && buildPlatform == hostPlatform && hostPlatform == targetPlatform) (fetchpatch {
         name = "gcc-13-darwin-aarch64-support.patch";
-        url = "https://github.com/Homebrew/formula-patches/raw/5c206c47e2a08d522ec9795bb314346fff5fc4c5/gcc/gcc-13.1.0.diff";
-        sha256 = "sha256-sMgA7nwE2ULa54t5g6VE6eJQYa69XvQrefi9U9f2t4g=";
+        url = "https://raw.githubusercontent.com/Homebrew/formula-patches/3c5cbc8e9cf444a1967786af48e430588e1eb481/gcc/gcc-13.2.0.diff";
+        sha256 = "sha256-Y5r3U3dwAFG6+b0TNCFd18PNxYu2+W/5zDbZ5cHvv+U=";
       })
       ++ optional langD ../libphobos.patch
 
@@ -201,7 +201,7 @@ lib.pipe ((callFile ../common/builder.nix {}) ({
 
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "sha256-YdaE8Kpedqxlha2ImKJCeq3ol57V5/hUkihsTfwT7oY=";
+    hash = "sha256-4nXnZEKmBnNBon8Exca4PYYTFEAEwEE1KIY9xrXHQ9o=";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/gcc/13/no-sys-dirs-riscv.patch b/pkgs/development/compilers/gcc/13/no-sys-dirs-riscv.patch
new file mode 100644
index 0000000000000..add4d59b41aef
--- /dev/null
+++ b/pkgs/development/compilers/gcc/13/no-sys-dirs-riscv.patch
@@ -0,0 +1,13 @@
+--- a/gcc/config/riscv/linux.h
++++ b/gcc/config/riscv/linux.h
+@@ -69,9 +69,5 @@
+ 
+ #define TARGET_ASM_FILE_END file_end_indicate_exec_stack
+ 
+-#define STARTFILE_PREFIX_SPEC 			\
+-   "/lib" XLEN_SPEC "/" ABI_SPEC "/ "		\
+-   "/usr/lib" XLEN_SPEC "/" ABI_SPEC "/ "	\
+-   "/lib/ "					\
+-   "/usr/lib/ "
++#define STARTFILE_PREFIX_SPEC ""
+ 
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index de74e99d9bb4e..5490bc1fc598c 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -166,7 +166,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $GOROOT_FINAL
     cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
     runHook postInstall
   '';
 
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 0ce8fcc659a88..d123c69319ee5 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -166,7 +166,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $GOROOT_FINAL
     cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
     runHook postInstall
   '';
 
diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index 18fa8db98792e..3364ea3540194 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.20.6";
+  version = "1.20.7";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    hash = "sha256-Yu5bxvtVuLro9wXgy434bWRTYmtOz5MnnihnCS4Lf3A=";
+    hash = "sha256-LF7pyeweczsNu8K9/tP2IwblHYFyvzj09OVCsnUg9Zc=";
   };
 
   strictDeps = true;
@@ -158,7 +158,8 @@ stdenv.mkDerivation rec {
     runHook preInstall
     mkdir -p $GOROOT_FINAL
     cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
     runHook postInstall
   '';
 
diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
new file mode 100644
index 0000000000000..1c9404faadc62
--- /dev/null
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -0,0 +1,183 @@
+{ lib
+, stdenv
+, fetchurl
+, tzdata
+, substituteAll
+, iana-etc
+, Security
+, Foundation
+, xcbuild
+, mailcap
+, buildPackages
+, pkgsBuildTarget
+, threadsCross
+, testers
+, skopeo
+, buildGo121Module
+}:
+
+let
+  useGccGoBootstrap = stdenv.buildPlatform.isMusl || stdenv.buildPlatform.isRiscV;
+  goBootstrap = if useGccGoBootstrap then buildPackages.gccgo12 else buildPackages.callPackage ./bootstrap117.nix { };
+
+  skopeoTest = skopeo.override { buildGoModule = buildGo121Module; };
+
+  goarch = platform: {
+    "aarch64" = "arm64";
+    "arm" = "arm";
+    "armv5tel" = "arm";
+    "armv6l" = "arm";
+    "armv7l" = "arm";
+    "i686" = "386";
+    "mips" = "mips";
+    "mips64el" = "mips64le";
+    "mipsel" = "mipsle";
+    "powerpc64le" = "ppc64le";
+    "riscv64" = "riscv64";
+    "s390x" = "s390x";
+    "x86_64" = "amd64";
+  }.${platform.parsed.cpu.name} or (throw "Unsupported system: ${platform.parsed.cpu.name}");
+
+  # We need a target compiler which is still runnable at build time,
+  # to handle the cross-building case where build != host == target
+  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
+
+  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
+in
+stdenv.mkDerivation rec {
+  pname = "go";
+  version = "1.21rc4";
+
+  src = fetchurl {
+    url = "https://go.dev/dl/go${version}.src.tar.gz";
+    hash = "sha256-IyTyDxERKuw+XV5CjQRoYaNOT5neCrgqjZFNJrj7Af0=";
+  };
+
+  strictDeps = true;
+  buildInputs = [ ]
+    ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
+    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
+
+  depsTargetTargetPropagated = lib.optionals stdenv.targetPlatform.isDarwin [ Foundation Security xcbuild ];
+
+  depsBuildTarget = lib.optional isCross targetCC;
+
+  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross.package;
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  patches = [
+    (substituteAll {
+      src = ./iana-etc-1.17.patch;
+      iana = iana-etc;
+    })
+    # Patch the mimetype database location which is missing on NixOS.
+    # but also allow static binaries built with NixOS to run outside nix
+    (substituteAll {
+      src = ./mailcap-1.17.patch;
+      inherit mailcap;
+    })
+    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
+    # that run outside a nix server
+    (substituteAll {
+      src = ./tzdata-1.19.patch;
+      inherit tzdata;
+    })
+    ./remove-tools-1.11.patch
+    ./go_no_vendor_checks-1.21.patch
+  ];
+
+  GOOS = stdenv.targetPlatform.parsed.kernel.name;
+  GOARCH = goarch stdenv.targetPlatform;
+  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+  # Go will nevertheless build a for host system that we will copy over in
+  # the install phase.
+  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
+  GOHOSTARCH = goarch stdenv.buildPlatform;
+
+  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+  # to be different from CC/CXX
+  CC_FOR_TARGET =
+    if isCross then
+      "${targetCC}/bin/${targetCC.targetPrefix}cc"
+    else
+      null;
+  CXX_FOR_TARGET =
+    if isCross then
+      "${targetCC}/bin/${targetCC.targetPrefix}c++"
+    else
+      null;
+
+  GOARM = toString (lib.intersectLists [ (stdenv.hostPlatform.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
+  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
+  CGO_ENABLED = 1;
+
+  GOROOT_BOOTSTRAP = if useGccGoBootstrap then goBootstrap else "${goBootstrap}/share/go";
+
+  buildPhase = ''
+    runHook preBuild
+    export GOCACHE=$TMPDIR/go-cache
+    # this is compiled into the binary
+    export GOROOT_FINAL=$out/share/go
+
+    export PATH=$(pwd)/bin:$PATH
+
+    ${lib.optionalString isCross ''
+    # Independent from host/target, CC should produce code for the building system.
+    # We only set it when cross-compiling.
+    export CC=${buildPackages.stdenv.cc}/bin/cc
+    ''}
+    ulimit -a
+
+    pushd src
+    ./make.bash
+    popd
+    runHook postBuild
+  '';
+
+  preInstall = ''
+    # Contains the wrong perl shebang when cross compiling,
+    # since it is not used for anything we can deleted as well.
+    rm src/regexp/syntax/make_perl_groups.pl
+  '' + (if (stdenv.buildPlatform.system != stdenv.hostPlatform.system) then ''
+    mv bin/*_*/* bin
+    rmdir bin/*_*
+    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
+      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
+    ''}
+  '' else lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system) ''
+    rm -rf bin/*_*
+    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
+      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
+    ''}
+  '');
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $GOROOT_FINAL
+    cp -a bin pkg src lib misc api doc $GOROOT_FINAL
+    mkdir -p $out/bin
+    ln -s $GOROOT_FINAL/bin/* $out/bin
+    runHook postInstall
+  '';
+
+  disallowedReferences = [ goBootstrap ];
+
+  passthru = {
+    inherit goBootstrap skopeoTest;
+    tests = {
+      skopeo = testers.testVersion { package = skopeoTest; };
+    };
+  };
+
+  meta = with lib; {
+    changelog = "https://go.dev/doc/devel/release#go${lib.versions.majorMinor version}";
+    description = "The Go Programming language";
+    homepage = "https://go.dev/";
+    license = licenses.bsd3;
+    maintainers = teams.golang.members;
+    platforms = platforms.darwin ++ platforms.linux;
+  };
+}
diff --git a/pkgs/development/compilers/go/go_no_vendor_checks-1.21.patch b/pkgs/development/compilers/go/go_no_vendor_checks-1.21.patch
new file mode 100644
index 0000000000000..1adbf46398c5c
--- /dev/null
+++ b/pkgs/development/compilers/go/go_no_vendor_checks-1.21.patch
@@ -0,0 +1,23 @@
+Starting from go1.14, go verifes that vendor/modules.txt matches the requirements
+and replacements listed in the main module go.mod file, and it is a hard failure if
+vendor/modules.txt is missing.
+
+Relax module consistency checks and switch back to pre go1.14 behaviour if
+vendor/modules.txt is missing regardless of go version requirement in go.mod.
+
+This has been ported from FreeBSD: https://reviews.freebsd.org/D24122
+See https://github.com/golang/go/issues/37948 for discussion.
+
+diff --git a/src/cmd/go/internal/modload/vendor.go b/src/cmd/go/internal/modload/vendor.go
+index ffc79bb93f..2d0311975d 100644
+--- a/src/cmd/go/internal/modload/vendor.go
++++ b/src/cmd/go/internal/modload/vendor.go
+@@ -144,7 +144,7 @@ func checkVendorConsistency(index *modFileIndex, modFile *modfile.File) {
+ 	readVendorList(MainModules.mustGetSingleMainModule())
+
+ 	pre114 := false
+-	if gover.Compare(index.goVersion, "1.14") < 0 {
++	if gover.Compare(index.goVersion, "1.14") < 0 || (os.Getenv("GO_NO_VENDOR_CHECKS") == "1" && len(vendorMeta) == 0) {
+ 		// Go versions before 1.14 did not include enough information in
+ 		// vendor/modules.txt to check for consistency.
+ 		// If we know that we're on an earlier version, relax the consistency check.
diff --git a/pkgs/development/compilers/openjdk/darwin/11.nix b/pkgs/development/compilers/openjdk/darwin/11.nix
index 1ca2901b048dd..48de376793853 100644
--- a/pkgs/development/compilers/openjdk/darwin/11.nix
+++ b/pkgs/development/compilers/openjdk/darwin/11.nix
@@ -11,26 +11,26 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "11.48.21";
-      jdkVersion = "11.0.11";
-      sha256 =
-        if enableJavaFX then "18bd9cd66d6abc6f8c627bc70278dc8fd4860e138e1dc9e170eddb89727ccc7b"
-        else "0v0n7h7i04pvna41wpdq2k9qiy70sbbqzqzvazfdvgm3gb22asw6";
+      zuluVersion = "11.66.15";
+      jdkVersion = "11.0.20";
+      hash =
+        if enableJavaFX then "sha256-pVgCJkgYTlFeL7nkkMWLeJ/J8ELhgvWb7gzf3erZP7Y="
+        else "sha256-vKqxHP5Yb651g8bZ0xHGQ4Q1T7JjjrmgEuykw/Gh2f0=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "11.48.21";
-      jdkVersion = "11.0.11";
-      sha256 =
-        if enableJavaFX then "ef0de2705c6c2d586812f7f3736b70e22b069545b38034816016f9f264ad43f9"
-        else "066whglrxx81c95grv2kxdbvyh32728ixhml2v44ildh549n4lhc";
+      zuluVersion = "11.66.15";
+      jdkVersion = "11.0.20";
+      hash =
+        if enableJavaFX then "sha256-VoZo34SCUU+HHnTl6iLe0QBC+4VDkPP14N98oqSg9EQ="
+        else "sha256-djK8Kfikt9SSuT87x1p7YWMIlNuF0TZFYDWrKiTTiIU=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
     url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
@@ -41,7 +41,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/16.nix b/pkgs/development/compilers/openjdk/darwin/16.nix
index b8f6b2d62ad4f..657b3eeafeabd 100644
--- a/pkgs/development/compilers/openjdk/darwin/16.nix
+++ b/pkgs/development/compilers/openjdk/darwin/16.nix
@@ -11,26 +11,26 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "16.30.15";
-      jdkVersion = "16.0.1";
-      sha256 =
-        if enableJavaFX then "cbb3b96d80a0675893f21dc51ba3f532049c501bd7dc4c8d1ee930e63032c745"
-        else "1jihn125dmxr9y5h9jq89zywm3z6rbwv5q7msfzsf2wzrr13jh0z";
+      zuluVersion = "16.32.15";
+      jdkVersion = "16.0.2";
+      hash =
+        if enableJavaFX then "sha256-6URaSBNHQWLauO//kCuKXb4Z7AqyshWnoeJEyVRKgaY="
+        else "sha256-NXgBj/KixTknaCYbo3B+rOo11NImH5CDUIU0LhTCtMo=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "16.30.19";
-      jdkVersion = "16.0.1";
-      sha256 =
-        if enableJavaFX then "a49b23abfd83784d2ac935fc24e25ab7cb09b8ffc8e47c32ed446e05b8a21396"
-        else "1i0bcjx3acb5dhslf6cabdcnd6mrz9728vxw9hb4al5y3f5fll4w";
+      zuluVersion = "16.32.15";
+      jdkVersion = "16.0.2";
+      hash =
+        if enableJavaFX then "sha256-QuyhIAxUY3Vv1adGihW+LIsXtpDX2taCmFsMFj9o5vs="
+        else "sha256-3bUfDcLLyahLeURFAgLAVapBZHvqtam8GHbWTA6MQog=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
     url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
@@ -41,7 +41,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/17.nix b/pkgs/development/compilers/openjdk/darwin/17.nix
index 51f12864de82e..3034e164e640e 100644
--- a/pkgs/development/compilers/openjdk/darwin/17.nix
+++ b/pkgs/development/compilers/openjdk/darwin/17.nix
@@ -1,36 +1,47 @@
-{ lib, stdenv, fetchurl, unzip, setJavaClassPath }:
+{ lib
+, stdenv
+, fetchurl
+, unzip
+, setJavaClassPath
+, enableJavaFX ? false
+}:
 let
   # Details from https://www.azul.com/downloads/?version=java-17-lts&os=macos&package=jdk
   # Note that the latest build may differ by platform
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "17.34.19";
-      jdkVersion = "17.0.3";
-      sha256 = "sha256-qImyxVC2y2QhxuVZwamKPyo46+n+7ytIFXpYI0e6w2c=";
+      zuluVersion = "17.44.15";
+      jdkVersion = "17.0.8";
+      hash =
+        if enableJavaFX then "sha256-gmDku/AkWzO+eDRitezM9wCtTYDrUMtXyMulxqi9tNI="
+        else "sha256-Ci18gBkAv/UUIQw9KlnfibcQMXwQRGx6K7L/NBB7b7Q=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "17.34.19";
-      jdkVersion = "17.0.3";
-      sha256 = "sha256-eaRX8Qa/Mqr9JhpHSEcf0Q9c4qmqLMgWqRhkEEwAjf8=";
+      zuluVersion = "17.44.15";
+      jdkVersion = "17.0.8";
+      hash =
+        if enableJavaFX then "sha256-mvyfqpnAoA05HJB9EBewW2MDuhQBOvp6svzyayV1irI="
+        else "sha256-8b81QY6DGXVOsTKM8QDzJnYjXV0ipCbYWaaz6oF2A6k=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
+  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
+
   jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-ca-jdk";
+    pname = "zulu${dist.zuluVersion}-${javaPackage}";
     version = dist.jdkVersion;
 
     src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/18.nix b/pkgs/development/compilers/openjdk/darwin/18.nix
index 4744407e5fd24..30a61b4b1faaf 100644
--- a/pkgs/development/compilers/openjdk/darwin/18.nix
+++ b/pkgs/development/compilers/openjdk/darwin/18.nix
@@ -1,36 +1,47 @@
-{ lib, stdenv, fetchurl, unzip, setJavaClassPath }:
+{ lib
+, stdenv
+, fetchurl
+, unzip
+, setJavaClassPath
+, enableJavaFX ? false
+}:
 let
   # Details from https://www.azul.com/downloads/?version=java-18-sts&os=macos&package=jdk
   # Note that the latest build may differ by platform
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "18.28.13";
-      jdkVersion = "18.0.0";
-      sha256 = "0hc5m3d4q3n7sighq3pxkdg93vsrgj1kzla1py9nfnm9pnj9l2kq";
+      zuluVersion = "18.32.13";
+      jdkVersion = "18.0.2.1";
+      hash =
+        if enableJavaFX then "sha256-ZVZ1gbpJwxTduq2PPOCKqbSl+shq2NTFgqG++OXvFcg="
+        else "sha256-uHPcyOgxUdTgzmIVRp/awtwve9zSt+1TZNef7DUuoRg=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "18.28.13";
-      jdkVersion = "18.0.0";
-      sha256 = "0ch4jp2d4pjvxbmbswvjwf7w2flajrvjg5f16ggiy80y8l0y15cm";
+      zuluVersion = "18.32.13";
+      jdkVersion = "18.0.2.1";
+      hash =
+        if enableJavaFX then "sha256-tNx0a1u9iamcN9VFOJ3eqDEA6C204dtIBJZvuAH2Vjk="
+        else "sha256-jAZDgxtWMq/74yKAxA69oOU0C9nXvKG5MjmZLsK04iM=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
+  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
+
   jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-ca-jdk";
+    pname = "zulu${dist.zuluVersion}-${javaPackage}";
     version = dist.jdkVersion;
 
     src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/19.nix b/pkgs/development/compilers/openjdk/darwin/19.nix
index e582c4016a542..a087de1b5727f 100644
--- a/pkgs/development/compilers/openjdk/darwin/19.nix
+++ b/pkgs/development/compilers/openjdk/darwin/19.nix
@@ -1,36 +1,47 @@
-{ lib, stdenv, fetchurl, unzip, setJavaClassPath }:
+{ lib
+, stdenv
+, fetchurl
+, unzip
+, setJavaClassPath
+, enableJavaFX ? false
+}:
 let
   # Details from https://www.azul.com/downloads/?version=java-19-sts&os=macos&package=jdk
   # Note that the latest build may differ by platform
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "19.30.11";
-      jdkVersion = "19.0.1";
-      sha256 = "1h0qj0xgpxjy506ikbgdn74pi4860lsnh5n3q3bayfmn0pxc5ksn";
+      zuluVersion = if enableJavaFX then "19.32.15" else "19.32.13";
+      jdkVersion = "19.0.2";
+      hash =
+        if enableJavaFX then "sha256-AwLcIId0gH5D6DUU8CgJ3qnKVQm28LXYirBeXBHwPYE="
+        else "sha256-KARXWumsY+OcqpEOV2EL9SsPni1nGSipjRji/Mn2KsE=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "19.30.11";
-      jdkVersion = "19.0.1";
-      sha256 = "0g8i371h5fv686xhiff0431sgvdk80lbp2lkz86jpfdv9lgg0qnk";
+      zuluVersion = if enableJavaFX then "19.32.15" else "19.32.13";
+      jdkVersion = "19.0.2";
+      hash =
+        if enableJavaFX then "sha256-/R2rrcBr64qPGEtvhruXBhPwnvurt/hiR1ICzZAdYxE="
+        else "sha256-F30FjZaLL756X/Xs6xjNwW9jds4pEATxoxOeeLL7Y5E=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
+  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
+
   jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-ca-jdk";
+    pname = "zulu${dist.zuluVersion}-${javaPackage}";
     version = dist.jdkVersion;
 
     src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/20.nix b/pkgs/development/compilers/openjdk/darwin/20.nix
index e26592462e500..b0c62aafd78d5 100644
--- a/pkgs/development/compilers/openjdk/darwin/20.nix
+++ b/pkgs/development/compilers/openjdk/darwin/20.nix
@@ -1,36 +1,47 @@
-{ lib, stdenv, fetchurl, unzip, setJavaClassPath }:
+{ lib
+, stdenv
+, fetchurl
+, unzip
+, setJavaClassPath
+, enableJavaFX ? false
+}:
 let
   # Details from https://www.azul.com/downloads/?version=java-19-sts&os=macos&package=jdk
   # Note that the latest build may differ by platform
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "20.30.11";
-      jdkVersion = "20.0.1";
-      sha256 = "0hg2n2mdbpxsgpw3c58w8y1f3im6schvfqahji352p9ljbdykzmy";
+      zuluVersion = "20.32.11";
+      jdkVersion = "20.0.2";
+      hash =
+        if enableJavaFX then "sha256-hyxQAivZAXtqMebe30L+EYa7p+TdSdKNYj7Rl/ZwRNQ="
+        else "sha256-Ev9KG6DvuBnsZrOguLsO1KQzudHCBcJNwKh45Inpnfo=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "20.30.11";
-      jdkVersion = "20.0.1";
-      sha256 = "0bc9h1y0b2azyfl3f5sqj19sh02xs995d1kdn55m4lfhc00rzr81";
+      zuluVersion = "20.32.11";
+      jdkVersion = "20.0.2";
+      hash =
+        if enableJavaFX then "sha256-iPQzZS4CwaoqT8cSzg4kWCT1OyGBSJLq+NETcbucLo4="
+        else "sha256-15uNZ6uMfSASV3QU2q2oA/jBk2PCHOfSjn1GY7/7qIY=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
-    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
-    url = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
+  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
+
   jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-ca-jdk";
+    pname = "zulu${dist.zuluVersion}-${javaPackage}";
     version = dist.jdkVersion;
 
     src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-ca-jdk${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/openjdk/darwin/8.nix b/pkgs/development/compilers/openjdk/darwin/8.nix
index 3048c53f10f2d..9bfd9a8db1a39 100644
--- a/pkgs/development/compilers/openjdk/darwin/8.nix
+++ b/pkgs/development/compilers/openjdk/darwin/8.nix
@@ -11,26 +11,26 @@ let
   dist = {
     x86_64-darwin = {
       arch = "x64";
-      zuluVersion = "8.54.0.21";
-      jdkVersion = "8.0.292";
-      sha256 =
-        if enableJavaFX then "e671f8990229b1ca2a76faabb21ba2f1a9e1f7211392e0f657225559be9b05c8"
-        else "1pgl0bir4r5v349gkxk54k6v62w241q7vw4gjxhv2g6pfq6hv7in";
+      zuluVersion = "8.72.0.17";
+      jdkVersion = "8.0.382";
+      hash =
+        if enableJavaFX then "sha256-/x8FqygivzddXsOwIV8aj/u+LPXMmokgu97vLAVEv80="
+        else "sha256-3dTPIPGUeT6nb3gncNvEa4VTRyQIBJpp8oZadrT2ToE=";
     };
 
     aarch64-darwin = {
       arch = "aarch64";
-      zuluVersion = "8.54.0.21";
-      jdkVersion = "8.0.292";
-      sha256 =
-        if enableJavaFX then "8e901075cde2c31f531a34e8321ea4201970936abf54240a232e9389952afe84"
-        else "05w89wfjlfbpqfjnv6wisxmaf13qb28b2223f9264jyx30qszw1c";
+      zuluVersion = "8.72.0.17";
+      jdkVersion = "8.0.382";
+      hash =
+        if enableJavaFX then "sha256-FkQ+0MzSZWUzc/HmiDVZEHGOrdKAVCdK5pm9wXXzzaU="
+        else "sha256-rN5AI4xAWppE4kJlzMod0JmGyHdHjTXYtx8/wOW6CFk=";
     };
   }."${stdenv.hostPlatform.system}";
 
   jce-policies = fetchurl {
     url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
   };
 
   javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
@@ -44,7 +44,7 @@ let
 
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) sha256;
+      inherit (dist) hash;
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
     };
 
diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix
index 821d61229d8d2..30fb18db8fd22 100644
--- a/pkgs/development/compilers/swift/compiler/default.nix
+++ b/pkgs/development/compilers/swift/compiler/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , callPackage
 , cmake
+, bash
 , coreutils
 , gnugrep
 , perl
@@ -133,7 +134,8 @@ let
     sed < '${clang}/bin/clang' > "$targetFile" \
       -e 's|^\s*exec|exec -a "$0"|g' \
       -e 's|^\[\[ "${clang.cc}/bin/clang" = \*++ ]]|[[ "$0" = *++ ]]|' \
-      -e "s|${clang.cc}/bin/clang|$unwrappedClang|g"
+      -e "s|${clang.cc}/bin/clang|$unwrappedClang|g" \
+      -e "s|^\(\s*\)\($unwrappedClang\) \"@\\\$responseFile\"|\1argv0=\$0\n\1${bash}/bin/bash -c \"exec -a '\$argv0' \2 '@\$responseFile'\"|"
     chmod a+x "$targetFile"
   '';
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-1.8.sh b/pkgs/development/interpreters/guile/setup-hook-1.8.sh
index 946e595ac0bf5..9a6ffb793a78b 100644
--- a/pkgs/development/interpreters/guile/setup-hook-1.8.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-1.8.sh
@@ -1,6 +1,6 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
     fi
 }
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.0.sh b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
index d83f9c6470573..9ef0fae011b58 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
@@ -1,18 +1,18 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/2.0"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.0"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.0"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site/2.0"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site/2.0"
     elif test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site"
     fi
 
     if test -d "$1/lib/guile/2.0/ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.0/ccache"
     fi
 
     if test -d "$1/lib/guile/2.0/site-ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/site-ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.0/site-ccache"
     fi
 }
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.2.sh b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
index d6bb23e7949a5..932a5b6c41e64 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.2.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
@@ -1,18 +1,18 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/2.2"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.2"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.2"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site/2.2"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site/2.2"
     elif test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site"
     fi
 
     if test -d "$1/lib/guile/2.2/ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.2/ccache"
     fi
 
     if test -d "$1/lib/guile/2.2/site-ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/site-ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/2.2/site-ccache"
     fi
 }
 
diff --git a/pkgs/development/interpreters/guile/setup-hook-3.0.sh b/pkgs/development/interpreters/guile/setup-hook-3.0.sh
index 903a1ebfb2357..1a71e82d13a22 100644
--- a/pkgs/development/interpreters/guile/setup-hook-3.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-3.0.sh
@@ -1,24 +1,24 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/3.0"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/3.0"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/3.0"
-        export GUILE_EXTENSIONS_PATH="${GUILE_EXTENSIONS_PATH-}${GUILE_EXTENSIONS_PATH:+:}$1/share/guile/site/3.0"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site/3.0"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site/3.0"
+        addToSearchPath GUILE_EXTENSIONS_PATH "$1/share/guile/site/3.0"
     elif test -d "$1/share/guile/site"; then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
-        export GUILE_EXTENSIONS_PATH="${GUILE_EXTENSIONS_PATH-}${GUILE_EXTENSIONS_PATH:+:}$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/share/guile/site"
+        addToSearchPath GUILE_EXTENSIONS_PATH "$1/share/guile/site"
     fi
 
     if test -d "$1/lib/guile/3.0/ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/3.0/ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/3.0/ccache"
     fi
 
     if test -d "$1/lib/guile/3.0/site-ccache"; then
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/3.0/site-ccache"
+        addToSearchPath GUILE_LOAD_COMPILED_PATH "$1/lib/guile/3.0/site-ccache"
     fi
 
     if test -d "$1/lib/guile/3.0/extensions"; then
-        export GUILE_EXTENSIONS_PATH="${GUILE_EXTENSIONS_PATH-}${GUILE_EXTENSIONS_PATH:+:}$1/lib/guile/3.0/extensions"
+        addToSearchPath GUILE_EXTENSIONS_PATH "$1/lib/guile/3.0/extensions"
     fi
 }
 
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index 7fe41a6f85335..46b01999f96c2 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -1,9 +1,9 @@
-self: super: with self;
+self: dontUse: with self;
 
 let
-  pythonInterpreter = super.python.pythonForBuild.interpreter;
-  pythonSitePackages = super.python.sitePackages;
-  pythonCheckInterpreter = super.python.interpreter;
+  pythonInterpreter = python.pythonForBuild.interpreter;
+  pythonSitePackages = python.sitePackages;
+  pythonCheckInterpreter = python.interpreter;
   setuppy = ../run_setup.py;
 in {
   makePythonHook = args: pkgs.makeSetupHook ({passthru.provides.setupHook = true; } // args);
diff --git a/pkgs/development/interpreters/python/passthrufun.nix b/pkgs/development/interpreters/python/passthrufun.nix
index f0654a91c75a8..867027e3841c9 100644
--- a/pkgs/development/interpreters/python/passthrufun.nix
+++ b/pkgs/development/interpreters/python/passthrufun.nix
@@ -47,11 +47,12 @@
         selfTargetTarget = pythonOnTargetForTarget.pkgs or {}; # There is no Python TargetTarget.
       };
       hooks = import ./hooks/default.nix;
-      keep = lib.extends hooks pythonPackagesFun;
+      keep = self: hooks self {};
       optionalExtensions = cond: as: lib.optionals cond as;
       pythonExtension = import ../../../top-level/python-packages.nix;
       python2Extension = import ../../../top-level/python2-packages.nix;
       extensions = lib.composeManyExtensions ([
+        hooks
         pythonExtension
       ] ++ (optionalExtensions (!self.isPy3k) [
         python2Extension
@@ -61,7 +62,7 @@
       aliases = self: super: lib.optionalAttrs config.allowAliases (import ../../../top-level/python-aliases.nix lib self super);
     in makeScopeWithSplicing' {
       inherit otherSplices keep;
-      f = lib.extends (lib.composeExtensions aliases extensions) keep;
+      f = lib.extends (lib.composeExtensions aliases extensions) pythonPackagesFun;
     }) {
       overrides = packageOverrides;
       python = self;
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index e99155f0f3a7b..11119b768825c 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.17";
+  version = "3.4.18";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-SvqqlGPiqHeZQ0Mvulbgc5bM7E1O3HK7BtnbiscG0vE=";
+    hash = "sha256-+yHTJWedZNCkkRMIRT103QMTFJODlbJ2PwVbTghEo0M=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/abseil-cpp/202301.nix b/pkgs/development/libraries/abseil-cpp/202301.nix
index a1c42c5df4b4f..da5f1fc029e16 100644
--- a/pkgs/development/libraries/abseil-cpp/202301.nix
+++ b/pkgs/development/libraries/abseil-cpp/202301.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , cmake
+, gtest
 , static ? stdenv.hostPlatform.isStatic
 , cxxStandard ? null
 }:
@@ -18,13 +19,19 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cmakeFlags = [
+    "-DABSL_BUILD_TEST_HELPERS=ON"
+    "-DABSL_USE_EXTERNAL_GOOGLETEST=ON"
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
   ] ++ lib.optionals (cxxStandard != null) [
     "-DCMAKE_CXX_STANDARD=${cxxStandard}"
   ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [ cmake ];
 
+  buildInputs = [ gtest ];
+
   meta = with lib; {
     description = "An open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
diff --git a/pkgs/development/libraries/arrow-cpp/cmake-find-protobuf.patch b/pkgs/development/libraries/arrow-cpp/cmake-find-protobuf.patch
new file mode 100644
index 0000000000000..5655c151e2f68
--- /dev/null
+++ b/pkgs/development/libraries/arrow-cpp/cmake-find-protobuf.patch
@@ -0,0 +1,18 @@
+diff --git a/cmake_modules/FindProtobufAlt.cmake b/cmake_modules/FindProtobufAlt.cmake
+index d29f757ae..61c6e16e1 100644
+--- a/cmake_modules/FindProtobufAlt.cmake
++++ b/cmake_modules/FindProtobufAlt.cmake
+@@ -22,11 +22,8 @@ else()
+ endif()
+ 
+ set(find_package_args)
+-if(ProtobufAlt_FIND_VERSION)
+-  list(APPEND find_package_args ${ProtobufAlt_FIND_VERSION})
+-endif()
+ if(ProtobufAlt_FIND_QUIETLY)
+   list(APPEND find_package_args QUIET)
+ endif()
+-find_package(Protobuf ${find_package_args})
+-set(ProtobufAlt_FOUND ${Protobuf_FOUND})
++find_package(protobuf ${find_package_args})
++set(ProtobufAlt_FOUND ${protobuf_FOUND})
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index f61d9aa221589..c1bbc3e303d15 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -39,11 +39,8 @@
 , enableShared ? !stdenv.hostPlatform.isStatic
 , enableFlight ? true
 , enableJemalloc ? !stdenv.isDarwin
-  # boost/process is broken in 1.69 on darwin, but fixed in 1.70 and
-  # non-existent in older versions
-  # see https://github.com/boostorg/process/issues/55
-, enableS3 ? (!stdenv.isDarwin) || (lib.versionOlder boost.version "1.69" || lib.versionAtLeast boost.version "1.70")
-, enableGcs ? (!stdenv.isDarwin) && (lib.versionAtLeast grpc.cxxStandard "17") # google-cloud-cpp is not supported on darwin, needs to support C++17
+, enableS3 ? true
+, enableGcs ? !stdenv.isDarwin
 }:
 
 assert lib.asserts.assertMsg
@@ -125,6 +122,7 @@ stdenv.mkDerivation rec {
   patches = [
     # patch to fix python-test
     ./darwin.patch
+    ./cmake-find-protobuf.patch
   ];
 
   nativeBuildInputs = [
@@ -172,6 +170,7 @@ stdenv.mkDerivation rec {
   '';
 
   cmakeFlags = [
+    "-DCMAKE_FIND_PACKAGE_PREFER_CONFIG=ON"
     "-DARROW_BUILD_SHARED=${if enableShared then "ON" else "OFF"}"
     "-DARROW_BUILD_STATIC=${if enableShared then "OFF" else "ON"}"
     "-DARROW_BUILD_TESTS=ON"
diff --git a/pkgs/development/libraries/audio/roc-toolkit/default.nix b/pkgs/development/libraries/audio/roc-toolkit/default.nix
index 878f499ccbbb2..c2cdd5285aa3a 100644
--- a/pkgs/development/libraries/audio/roc-toolkit/default.nix
+++ b/pkgs/development/libraries/audio/roc-toolkit/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "roc-toolkit";
-  version = "0.2.4";
+  version = "0.2.5";
 
   outputs = [ "out" "dev" ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "roc-streaming";
     repo = "roc-toolkit";
     rev = "v${version}";
-    hash = "sha256-x4+/MIFKcos9xWhvSNWdsUQA2oLiyYS0MJE60HY/3hQ=";
+    hash = "sha256-vosw4H3YTTCXdDOnQQYRNZgufPo1BxUtfg6jutArzTI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/coeurl/default.nix b/pkgs/development/libraries/coeurl/default.nix
index 9e779dea6d895..b0743e032c6ea 100644
--- a/pkgs/development/libraries/coeurl/default.nix
+++ b/pkgs/development/libraries/coeurl/default.nix
@@ -37,6 +37,9 @@ stdenv.mkDerivation rec {
       hash = "sha256-a52Id7Nm3Mmmwv7eL58j6xovjlkpAO4KahVM/Q3H65w=";
     })
   ];
+  postPatch = ''
+    substituteInPlace subprojects/curl.wrap --replace '[provides]' '[provide]'
+  '';
 
   nativeBuildInputs = [ ninja pkg-config meson ];
 
diff --git a/pkgs/development/libraries/fortify-headers/default.nix b/pkgs/development/libraries/fortify-headers/default.nix
new file mode 100644
index 0000000000000..befead87e6a13
--- /dev/null
+++ b/pkgs/development/libraries/fortify-headers/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation {
+  pname = "fortify-headers";
+  version = "1.1alpine1";
+
+  # upstream only accessible via git - unusable during bootstrap, hence
+  # extract from the alpine package
+  src = fetchurl {
+    url = "https://dl-cdn.alpinelinux.org/alpine/v3.17/main/x86_64/fortify-headers-1.1-r1.apk";
+    name = "fortify-headers.tar.gz";  # ensure it's extracted as a .tar.gz
+    hash = "sha256-A67NzUv+dldARY+MTaoVnezTg+Es8ZK/b7XOxA6KzpI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -r include/fortify $out/include
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Standalone header-based fortify-source implementation";
+    homepage = "https://git.2f30.org/fortify-headers";
+    license = lib.licenses.bsd0;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ ris ];
+  };
+}
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index bece2287c055a..d982b77297065 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -143,8 +143,9 @@ stdenv.mkDerivation (finalAttrs: {
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     };
 
-    # gdk_pixbuf_moduledir variable from gdk-pixbuf-2.0.pc
-    moduleDir = "lib/gdk-pixbuf-2.0/2.10.0/loaders";
+    # gdk_pixbuf_binarydir and gdk_pixbuf_moduledir variables from gdk-pixbuf-2.0.pc
+    binaryDir = "lib/gdk-pixbuf-2.0/2.10.0";
+    moduleDir = "${finalAttrs.passthru.binaryDir}/loaders";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index 86d6d1438b2dc..eddeb5e3ec4bb 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -12,14 +12,13 @@
 
 (callPackage ./common.nix { inherit stdenv; } {
   pname = "glibc-locales";
+  extraNativeBuildInputs = [ glibc ];
 }).overrideAttrs(finalAttrs: previousAttrs: {
 
   builder = ./locales-builder.sh;
 
   outputs = [ "out" ];
 
-  extraNativeBuildInputs = [ glibc ];
-
   LOCALEDEF_FLAGS = [
     (if stdenv.hostPlatform.isLittleEndian
     then "--little-endian"
@@ -60,7 +59,11 @@
       echo SUPPORTED-LOCALES='${toString locales}' > ../glibc-2*/localedata/SUPPORTED
     '';
 
-  enableParallelBuilding = true;
+  # Current `nixpkgs` way of building locales is not compatible with
+  # parallel install. `locale-archive` is updated in parallel with
+  # multiple `localedef` processes and causes non-deterministic result:
+  #   https://github.com/NixOS/nixpkgs/issues/245360
+  enableParallelBuilding = false;
 
   makeFlags = (previousAttrs.makeFlags or []) ++ [
     "localedata/install-locales"
diff --git a/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch b/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch
deleted file mode 100644
index eec8206dba05c..0000000000000
--- a/pkgs/development/libraries/gmp/6.2.1-CVE-2021-43618.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-https://gmplib.org/repo/gmp-6.2/raw-rev/561a9c25298e
-
-diff -r e1fd9db13b47 -r 561a9c25298e mpz/inp_raw.c
---- a/mpz/inp_raw.c	Tue Dec 22 23:49:51 2020 +0100
-+++ b/mpz/inp_raw.c	Thu Oct 21 19:06:49 2021 +0200
-@@ -88,8 +88,11 @@
- 
-   abs_csize = ABS (csize);
- 
-+  if (UNLIKELY (abs_csize > ~(mp_bitcnt_t) 0 / 8))
-+    return 0; /* Bit size overflows */
-+
-   /* round up to a multiple of limbs */
--  abs_xsize = BITS_TO_LIMBS (abs_csize*8);
-+  abs_xsize = BITS_TO_LIMBS ((mp_bitcnt_t) abs_csize * 8);
- 
-   if (abs_xsize != 0)
-     {
-
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 7857bfa0e3557..44874246b6ea4 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -13,15 +13,13 @@ let inherit (lib) optional; in
 
 let self = stdenv.mkDerivation rec {
   pname = "gmp${lib.optionalString cxx "-with-cxx"}";
-  version = "6.2.1";
+  version = "6.3.0";
 
   src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv
     urls = [ "mirror://gnu/gmp/gmp-${version}.tar.bz2" "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2" ];
-    sha256 = "0z2ddfiwgi0xbf65z4fg4hqqzlhv0cc6hdcswf3c6n21xdmk5sga";
+    hash = "sha256-rCghGnz7YJuuLiyNYFjWbI/pZDT3QM9v4uR7AA0cIMs=";
   };
 
-  patches = [ ./6.2.1-CVE-2021-43618.patch ];
-
   #outputs TODO: split $cxx due to libstdc++ dependency
   # maybe let ghc use a version with *.so shared with rest of nixpkgs and *.a added
   # - see #5855 for related discussion
diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index c0a3219808eb7..75a20bbbc355a 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -6,27 +6,26 @@
 # files.
 
 let
-  rev = "63acb96f92473ceb5e21d873d7c0aee266b3d6d3";
+  rev = "d4e37b5868ef910e3e52744c34408084bb13051c";
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
+    name = "config.guess-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
-    sha256 = "049qgfh4xjd4fxd7ygm1phd5faqphfvhfcv8dsdldprsp86lf55v";
+    sha256 = "191czpnbc1nxrygg8fd3839y1f4m9x43rp57vgrsas6p07zzh3c1";
   };
   configSub = fetchurl {
+    name = "config.sub-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
-    sha256 = "1rk30y27mzls49wyfdb5jhzjr08hkxl7xqhnxmhcmkvqlmpsjnxl";
+    sha256 = "0148p54gw10p6sk2rn3gi9vvqm89rk8kcvl9335ckayhanx31381";
   };
 in stdenv.mkDerivation {
   pname = "gnu-config";
-  version = "2023-01-21";
+  version = "2023-07-31";
 
   buildCommand = ''
-    mkdir -p $out
-    cp ${configGuess} $out/config.guess
-    cp ${configSub} $out/config.sub
-
-    chmod +x $out/config.*
+    install -Dm755 ${configGuess} $out/config.guess
+    install -Dm755 ${configSub} $out/config.sub
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 782df53fc4b8d..5f4a295e3b094 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -1,5 +1,6 @@
 { config, lib, stdenv, fetchurl, zlib, lzo, libtasn1, nettle, pkg-config, lzip
 , perl, gmp, autoconf, automake, libidn2, libiconv
+, fetchpatch, texinfo
 , unbound, dns-root-data, gettext, util-linux
 , cxxBindings ? !stdenv.hostPlatform.isStatic # tries to link libstdc++.so
 , tpmSupport ? false, trousers, which, nettools, libunistring
@@ -34,11 +35,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    sha256 = "sha256-DqDRGhZgoeY/lg8Vexl6vm0MjLMlW+JOH7OBWTC5vcU=";
+    hash = "sha256-uoueFa4gq6iPRGYZePW1hjSUMW/n5yLt6dBp/mKUgpw=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
@@ -46,7 +47,15 @@ stdenv.mkDerivation rec {
   outputInfo = "devdoc";
   outputDoc  = "devdoc";
 
-  patches = [ ./nix-ssl-cert-file.patch ];
+  patches = [
+    (fetchpatch { #TODO: when updating drop this patch and texinfo
+      name = "GNUTLS_NO_EXTENSIONS.patch";
+      url = "https://gitlab.com/gnutls/gnutls/-/commit/abfa8634db940115a11a07596ce53c8f9c4f87d2.diff";
+      hash = "sha256-3M5WdNoVx9gUwTUPgu/sXmsaNg+j5d6liXs0UZz8fGU=";
+    })
+
+    ./nix-ssl-cert-file.patch
+  ];
 
   # Skip some tests:
   #  - pkg-config: building against the result won't work before installing (3.5.11)
@@ -81,7 +90,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional (withP11-kit) p11-kit
     ++ lib.optional (tpmSupport && stdenv.isLinux) trousers;
 
-  nativeBuildInputs = [ perl pkg-config ]
+  nativeBuildInputs = [ perl pkg-config texinfo ]
     ++ lib.optionals doCheck [ which nettools util-linux ];
 
   propagatedBuildInputs = [ nettle ]
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index cb626ffac968c..9aa1284bbee9d 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -18,25 +18,25 @@
 , staticOnly ? stdenv.hostPlatform.isStatic
 }:
 let
-  googleapisRev = "13d5b3f3f9412f38427c8ad48068f04ad1ee9808";
+  googleapisRev = "85f8c758016c279fb7fa8f0d51ddc7ccc0dd5e05";
   googleapis = fetchFromGitHub {
     name = "googleapis-src";
     owner = "googleapis";
     repo = "googleapis";
     rev = googleapisRev;
-    hash = "sha256-SiU7N1EQ/7LWhUwgf4c0CBfUzNGiLe4sSbbJmJF3sao=";
+    hash = "sha256-4Qiz0pBgW3OZi+Z8Zq6k9E94+8q6/EFMwPh8eQxDjdI=";
   };
   excludedTests = builtins.fromTOML (builtins.readFile ./skipped_tests.toml);
 in
 stdenv.mkDerivation rec {
   pname = "google-cloud-cpp";
-  version = "2.4.0";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-cpp";
     rev = "v${version}";
-    sha256 = "sha256-o8aURM8fvxn0FZjuqJGclq9Brss8LOFZzD0FV2j/lUc=";
+    sha256 = "sha256-0SoOaAqvk8cVC5W3ejTfe4O/guhrro3uAzkeIpAkCpg=";
   };
 
   postPatch = ''
@@ -120,7 +120,6 @@ stdenv.mkDerivation rec {
     # this adds a good chunk of time to the build
     "-DBUILD_TESTING:BOOL=ON"
     "-DGOOGLE_CLOUD_CPP_ENABLE_EXAMPLES:BOOL=OFF"
-    "-DCMAKE_CXX_STANDARD=${grpc.cxxStandard}"
   ] ++ lib.optionals (apis != [ "*" ]) [
     "-DGOOGLE_CLOUD_CPP_ENABLE=${lib.concatStringsSep ";" apis}"
   ];
diff --git a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
index 71529bfb45500..d4ac469fbcffe 100644
--- a/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
+++ b/pkgs/development/libraries/google-cloud-cpp/skipped_tests.toml
@@ -1,56 +1,71 @@
 whole = [
-  "bigquery_bigquery_read_integration_test",
+  "common_samples_samples",
+  "common_internal_grpc_impersonate_service_account_integration_test",
+  "common_internal_unified_rest_credentials_integration_test",
+  "iam_samples_iam_credentials_samples",
+  "iam_samples_iam_samples",
+  "iam_admin_v1_samples_iam_client_samples",
+  "iam_credentials_v1_samples_iam_credentials_client_samples",
+  "iam_v1_samples_iam_policy_client_samples",
+  "iam_v2_samples_policies_client_samples",
   "bigtable_admin_admin_iam_policy_integration_test",
-  "bigtable_admin_iam_policy_integration_test",
-  "bigtable_admin_integration_test",
+  "bigtable_bigtable_instance_admin_client_samples",
+  "bigtable_bigtable_table_admin_client_samples",
   "bigtable_apply_read_latency_benchmark",
-  "bigtable_data_async_future_integration_test",
-  "bigtable_data_integration_test",
   "bigtable_endurance_benchmark",
-  "bigtable_filters_integration_test",
   "bigtable_mutation_batcher_throughput_benchmark",
-  "bigtable_mutations_integration_test",
   "bigtable_read_sync_vs_async_benchmark",
   "bigtable_scan_throughput_benchmark",
+  "bigtable_admin_iam_policy_integration_test",
+  "bigtable_data_async_future_integration_test",
+  "bigtable_data_integration_test",
+  "bigtable_filters_integration_test",
+  "bigtable_mutations_integration_test",
   "bigtable_table_sample_rows_integration_test",
-  "common_grpc_utils_internal_grpc_impersonate_service_account_integration_test",
-  "iam_iam_credentials_integration_test",
-  "iam_iam_integration_test",
+  "bigquery_samples_bigquery_read_samples",
+  "bigquery_analyticshub_v1_samples_analytics_hub_client_samples",
+  "bigquery_biglake_v1_samples_metastore_client_samples",
+  "bigquery_connection_v1_samples_connection_client_samples",
+  "bigquery_datapolicies_v1_samples_data_policy_client_samples",
+  "bigquery_datatransfer_v1_samples_data_transfer_client_samples",
+  "bigquery_migration_v2_samples_migration_client_samples",
+  "bigquery_reservation_v1_samples_reservation_client_samples",
+  "bigquery_storage_v1_samples_bigquery_read_client_samples",
+  "bigquery_storage_v1_samples_bigquery_write_client_samples",
   "logging_quickstart",
+  "logging_v2_samples_config_service_v2_client_samples",
+  "logging_v2_samples_logging_service_v2_client_samples",
+  "logging_v2_samples_metrics_service_v2_client_samples",
   "pubsub_endurance",
-  "pubsub_schema_admin_integration_test",
+  "pubsub_throughput",
   "pubsub_subscriber_integration_test",
   "pubsub_subscription_admin_integration_test",
-  "pubsub_throughput",
   "pubsub_topic_admin_integration_test",
-  "rest_internal_internal_curl_rest_client_integration_test",
-  "rest_internal_internal_unified_rest_credentials_integration_test",
-  "spanner_admin_backup_extra_integration_test",
-  "spanner_admin_database_admin_integration_test",
-  "spanner_admin_instance_admin_integration_test",
-  "spanner_backup_extra_integration_test",
   "spanner_client_integration_test",
   "spanner_client_stress_test",
   "spanner_data_types_integration_test",
   "spanner_database_admin_integration_test",
   "spanner_instance_admin_integration_test",
-  "spanner_multiple_rows_cpu_benchmark",
-  "spanner_rpc_failure_threshold_integration_test",
   "spanner_session_pool_integration_test",
+  "spanner_admin_database_admin_integration_test",
+  "spanner_admin_instance_admin_integration_test",
+  "spanner_database_admin_client_samples",
+  "spanner_instance_admin_client_samples",
+  "spanner_multiple_rows_cpu_benchmark",
   "spanner_single_row_throughput_benchmark",
-  "storage_aggregate_download_throughput_benchmark",
-  "storage_aggregate_upload_throughput_benchmark",
   "storage_alternative_endpoint_integration_test",
   "storage_auto_finalize_integration_test",
   "storage_bucket_integration_test",
   "storage_create_client_integration_test",
-  "storage_create_dataset",
-  "storage_curl_download_request_integration_test",
-  "storage_curl_request_integration_test",
-  "storage_curl_resumable_upload_session_integration_test",
   "storage_curl_sign_blob_integration_test",
   "storage_decompressive_transcoding_integration_test",
+  "storage_grpc_bucket_acl_integration_test",
+  "storage_grpc_bucket_metadata_integration_test",
+  "storage_grpc_default_object_acl_integration_test",
   "storage_grpc_integration_test",
+  "storage_grpc_object_acl_integration_test",
+  "storage_grpc_object_media_integration_test",
+  "storage_grpc_object_metadata_integration_test",
   "storage_key_file_integration_test",
   "storage_minimal_iam_credentials_rest_integration_test",
   "storage_object_basic_crud_integration_test",
@@ -79,13 +94,16 @@ whole = [
   "storage_service_account_integration_test",
   "storage_signed_url_integration_test",
   "storage_small_reads_integration_test",
-  "storage_storage_file_transfer_benchmark",
-  "storage_storage_parallel_uploads_benchmark",
-  "storage_storage_throughput_vs_cpu_benchmark",
   "storage_thread_integration_test",
-  "storage_throughput_experiment_test",
   "storage_tracing_integration_test",
   "storage_unified_credentials_integration_test",
+  "storage_aggregate_download_throughput_benchmark",
+  "storage_aggregate_upload_throughput_benchmark",
+  "storage_create_dataset",
+  "storage_storage_file_transfer_benchmark",
+  "storage_storage_parallel_uploads_benchmark",
+  "storage_storage_throughput_vs_cpu_benchmark",
+  "storage_throughput_experiment_test"
 ]
 cases = [
   "BackupExtraIntegrationTest.CreateBackupWithExpiredVersionTime",
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index 7ba6ec214cd04..77bba280df966 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.54.2"; # N.B: if you change this, please update:
+  version = "1.57.0"; # N.B: if you change this, please update:
     # pythonPackages.grpcio-tools
     # pythonPackages.grpcio-status
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-OIRqH+h8Kjbw3X5slpdCfNN0f027WuvHG3q7KUuSWo8=";
+    hash = "sha256-ZPhPi4ODAAohCySVKeypaDID4ZUXvnfidOGK5EMXvh4=";
     fetchSubmodules = true;
   };
 
@@ -40,6 +40,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/lopsided98/grpc/commit/164f55260262c816e19cd2c41b564486097d62fe.patch";
       hash = "sha256-d6kMyjL5ZnEnEz4XZfRgXJBH53gp1r7q1tlwh+HM6+Y=";
     })
+    # Fix generated CMake config file
+    # FIXME: remove when merged
+    (fetchpatch {
+      url = "https://github.com/grpc/grpc/pull/33361/commits/117dc80eb43021dd5619023ef6d02d0d6ec7ae7a.patch";
+      hash = "sha256-VBk3ZD5h9uOQVN0st+quUQK/wXqvfFNk8G8AN4f2MQo=";
+    })
   ];
 
   nativeBuildInputs = [ cmake pkg-config ]
@@ -56,10 +62,22 @@ stdenv.mkDerivation rec {
     "-DgRPC_PROTOBUF_PROVIDER=package"
     "-DgRPC_ABSL_PROVIDER=package"
     "-DBUILD_SHARED_LIBS=ON"
-    "-DCMAKE_CXX_STANDARD=${passthru.cxxStandard}"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "-D_gRPC_PROTOBUF_PROTOC_EXECUTABLE=${buildPackages.protobuf}/bin/protoc"
-  ];
+  ]
+  # The build scaffold defaults to c++14 on darwin, even when the compiler uses
+  # a more recent c++ version by default [1]. However, downgrades are
+  # problematic, because the compatibility types in abseil will have different
+  # interface definitions than the ones used for building abseil itself.
+  # [1] https://github.com/grpc/grpc/blob/v1.57.0/CMakeLists.txt#L239-L243
+  ++ (let
+    defaultCxxIsOlderThan17 =
+      (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.cc.version "16.0")
+       || (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.cc.version "11.0");
+    in lib.optionals (stdenv.hostPlatform.isDarwin && defaultCxxIsOlderThan17)
+  [
+    "-DCMAKE_CXX_STANDARD=17"
+  ]);
 
   # CMake creates a build directory by default, this conflicts with the
   # basel BUILD file on case-insensitive filesystems.
@@ -81,17 +99,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilds = true;
 
-  passthru.cxxStandard =
-    let
-      # Needs to be compiled with -std=c++11 for clang < 11. Interestingly this is
-      # only an issue with the useLLVM stdenv, not the darwin stdenv…
-      # https://github.com/grpc/grpc/issues/26473#issuecomment-860885484
-      useLLVMAndOldCC = (stdenv.hostPlatform.useLLVM or false) && lib.versionOlder stdenv.cc.cc.version "11.0";
-      # With GCC 9 (current aarch64-linux) it fails with c++17 but OK with c++14.
-      useOldGCC = !(stdenv.hostPlatform.useLLVM or false) && lib.versionOlder stdenv.cc.cc.version "10";
-    in
-    (if useLLVMAndOldCC then "11" else if useOldGCC then "14" else "17");
-
   passthru.tests = {
     inherit (python3.pkgs) grpcio-status grpcio-tools;
     inherit arrow-cpp;
diff --git a/pkgs/development/libraries/gupnp/1.6.nix b/pkgs/development/libraries/gupnp/1.6.nix
index da830a6366c93..8f5e002653fd8 100644
--- a/pkgs/development/libraries/gupnp/1.6.nix
+++ b/pkgs/development/libraries/gupnp/1.6.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gupnp";
-  version = "1.6.4";
+  version = "1.6.5";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gupnp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-1sPQNYOET6UqvgAwQxhgB/DIQUX+OwD6slmVvtqb5Vo=";
+    hash = "sha256-Q33/lwFC6EBwh6iYVfcX4g0nydduBbTNUX32IcfYiM0=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gupnp/default.nix b/pkgs/development/libraries/gupnp/default.nix
index 4bff529a5156b..4a8b250d26444 100644
--- a/pkgs/development/libraries/gupnp/default.nix
+++ b/pkgs/development/libraries/gupnp/default.nix
@@ -35,9 +35,18 @@ stdenv.mkDerivation rec {
     # Bring .pc file in line with our patched pkg-config.
     ./0001-pkg-config-Declare-header-dependencies-as-public.patch
 
+    # Unbreak build with Meson 1.2.0
+    # https://gitlab.gnome.org/GNOME/gupnp/-/merge_requests/33
+    (fetchpatch2 {
+      name = "meson-1.2-fix.patch";
+      url = "https://gitlab.gnome.org/GNOME/gupnp/-/commit/85c0244cfbf933d3e90d50ab68394c68d86f9ed5.patch";
+      hash = "sha256-poDhkEgDTpgGnTbbZLPwx8Alf0h81vmzJyx3izWmDGw=";
+    })
+
     # Fix build against libxml2 2.11
     # https://gitlab.gnome.org/GNOME/gupnp/-/merge_requests/34
     (fetchpatch2 {
+      name = "libxml2-2.11-fix.patch";
       url = "https://gitlab.gnome.org/GNOME/gupnp/-/commit/bc56f02b0f89e96f2bd74af811903d9931965f58.patch";
       hash = "sha256-KCHlq7Es+WLIWKgIgGVTaHarVQIiZPEi5r6nMAhXTgY=";
     })
diff --git a/pkgs/development/libraries/libavif/default.nix b/pkgs/development/libraries/libavif/default.nix
index dca45186d4ce4..eb8a8b1e3b542 100644
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@@ -8,8 +8,15 @@
 , libjpeg
 , dav1d
 , libyuv
+, gdk-pixbuf
+, makeWrapper
 }:
 
+let
+  gdkPixbufModuleDir = "${placeholder "out"}/${gdk-pixbuf.moduleDir}";
+  gdkPixbufModuleFile = "${placeholder "out"}/${gdk-pixbuf.binaryDir}/avif-loaders.cache";
+in
+
 stdenv.mkDerivation rec {
   pname = "libavif";
   version = "0.11.1";
@@ -29,14 +36,18 @@ stdenv.mkDerivation rec {
     "-DAVIF_CODEC_DAV1D=ON" # best decoder (fast)
     "-DAVIF_CODEC_AOM_DECODE=OFF"
     "-DAVIF_BUILD_APPS=ON"
+    "-DAVIF_BUILD_GDK_PIXBUF=ON"
   ];
 
   nativeBuildInputs = [
     cmake
     pkg-config
+    gdk-pixbuf
+    makeWrapper
   ];
 
   buildInputs = [
+    gdk-pixbuf
     libaom
     zlib
     libpng
@@ -45,6 +56,23 @@ stdenv.mkDerivation rec {
     libyuv
   ];
 
+  postPatch = ''
+    substituteInPlace contrib/gdk-pixbuf/avif.thumbnailer.in \
+      --replace '@CMAKE_INSTALL_FULL_BINDIR@/gdk-pixbuf-thumbnailer' "$out/libexec/gdk-pixbuf-thumbnailer-avif"
+  '';
+
+  env.PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = gdkPixbufModuleDir;
+
+  postInstall = ''
+    GDK_PIXBUF_MODULEDIR=${gdkPixbufModuleDir} \
+    GDK_PIXBUF_MODULE_FILE=${gdkPixbufModuleFile} \
+    gdk-pixbuf-query-loaders --update-cache
+
+    mkdir -p "$out/bin"
+    makeWrapper ${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer "$out/libexec/gdk-pixbuf-thumbnailer-avif" \
+      --set GDK_PIXBUF_MODULE_FILE ${gdkPixbufModuleFile}
+  '';
+
   meta = with lib; {
     description  = "C implementation of the AV1 Image File Format";
     longDescription = ''
diff --git a/pkgs/development/libraries/libhwy/default.nix b/pkgs/development/libraries/libhwy/default.nix
index afbbf69966bd8..4373f7474339a 100644
--- a/pkgs/development/libraries/libhwy/default.nix
+++ b/pkgs/development/libraries/libhwy/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     rev = version;
     hash = "sha256-Gym2iHq5ws9kuG4HWSQndD8hVugV4USZt6dUFnEkLwY=";
   };
-  patches = lib.optionals (with stdenv; isAarch64 && isLinux) [ # conditional, temporarily
+  patches = [
     # backport for compilation issue on aarch64
     # https://github.com/google/highway/issues/1613
     (fetchpatch {
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 6419f5a595786..d81a31ce05c43 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -4,6 +4,7 @@
 , pkg-config
 , glib
 , gdk-pixbuf
+, installShellFiles
 , pango
 , cairo
 , libxml2
@@ -59,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     gdk-pixbuf
+    installShellFiles
     pkg-config
     rustc
     cargo-auditable-cargo-wrapper
@@ -121,12 +123,10 @@ stdenv.mkDerivation (finalAttrs: {
   postConfigure = ''
     GDK_PIXBUF=$out/lib/gdk-pixbuf-2.0/2.10.0
     mkdir -p $GDK_PIXBUF/loaders
-    sed -e "s#gdk_pixbuf_moduledir = .*#gdk_pixbuf_moduledir = $GDK_PIXBUF/loaders#" \
-        -i gdk-pixbuf-loader/Makefile
-    sed -e "s#gdk_pixbuf_cache_file = .*#gdk_pixbuf_cache_file = $GDK_PIXBUF/loaders.cache#" \
-        -i gdk-pixbuf-loader/Makefile
-    sed -e "s#\$(GDK_PIXBUF_QUERYLOADERS)#GDK_PIXBUF_MODULEDIR=$GDK_PIXBUF/loaders \$(GDK_PIXBUF_QUERYLOADERS)#" \
-         -i gdk-pixbuf-loader/Makefile
+    sed -i gdk-pixbuf-loader/Makefile \
+      -e "s#gdk_pixbuf_moduledir = .*#gdk_pixbuf_moduledir = $GDK_PIXBUF/loaders#" \
+      -e "s#gdk_pixbuf_cache_file = .*#gdk_pixbuf_cache_file = $GDK_PIXBUF/loaders.cache#" \
+      -e "s#\$(GDK_PIXBUF_QUERYLOADERS)#GDK_PIXBUF_MODULEDIR=$GDK_PIXBUF/loaders \$(GDK_PIXBUF_QUERYLOADERS)#"
 
     # Fix thumbnailer path
     sed -e "s#@bindir@\(/gdk-pixbuf-thumbnailer\)#${gdk-pixbuf}/bin\1#g" \
@@ -147,12 +147,10 @@ stdenv.mkDerivation (finalAttrs: {
       cat ${lib.getLib gdk-pixbuf}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache > $GDK_PIXBUF/loaders.cache.tmp
       mv $GDK_PIXBUF/loaders.cache.tmp $GDK_PIXBUF/loaders.cache
 
-      mkdir -p "$out/share/bash-completion/completions/"
-      ${emulator} $out/bin/rsvg-convert --completion bash > "$out/share/bash-completion/completions/rsvg-convert"
-      mkdir -p "$out/share/zsh/site-functions/"
-      ${emulator} $out/bin/rsvg-convert --completion zsh > "$out/share/zsh/site-functions/_rsvg-convert"
-      mkdir -p "$out/share/fish/vendor_completions.d/"
-      ${emulator} $out/bin/rsvg-convert --completion fish > "$out/share/fish/vendor_completions.d/rsvg-convert.fish"
+      installShellCompletion --cmd rsvg-convert \
+        --bash <(${emulator} $out/bin/rsvg-convert --completion bash) \
+        --fish <(${emulator} $out/bin/rsvg-convert --completion fish) \
+        --zsh <(${emulator} $out/bin/rsvg-convert --completion zsh)
     '';
 
   postFixup = lib.optionalString withIntrospection ''
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 392786524a875..550cb7f673f81 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -86,8 +86,8 @@
 */
 
 let
-  version = "23.1.4";
-  hash = "sha256-cmGhf7lIZ+PcWpDYofEA+gSwy73lHSUwLAhytemhCVk=";
+  version = "23.1.5";
+  hash = "sha256-PPiFdv3r8k/EBHBnk2ExyQy2VBwnNlmWt5tmHewfsVM=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 0188e5e1ae965..d295efe6feed4 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , fetchpatch
 , cmake, pkg-config, unzip, zlib, pcre, hdf5
-, glog, boost, gflags, protobuf
+, glog, boost, gflags, protobuf3_21
 , config
 
 , enableJPEG      ? true, libjpeg
@@ -187,7 +187,7 @@ stdenv.mkDerivation {
 
   buildInputs =
        [ zlib pcre hdf5 glog boost gflags ]
-    ++ lib.optional useSystemProtobuf protobuf
+    ++ lib.optional useSystemProtobuf protobuf3_21
     ++ lib.optional enablePython pythonPackages.python
     ++ lib.optional enableGtk2 gtk2
     ++ lib.optional enableGtk3 gtk3
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index c82f0a0065b68..2bc3954f8ab94 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -11,7 +11,7 @@
 , hdf5
 , boost
 , gflags
-, protobuf
+, protobuf3_21
 , config
 , ocl-icd
 , buildPackages
@@ -317,7 +317,7 @@ stdenv.mkDerivation {
     echo '"(build info elided)"' > modules/core/version_string.inc
   '';
 
-  buildInputs = [ zlib pcre boost gflags protobuf ]
+  buildInputs = [ zlib pcre boost gflags protobuf3_21 ]
     ++ lib.optional enablePython pythonPackages.python
     ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) hdf5
     ++ lib.optional enableGtk2 gtk2
@@ -369,7 +369,7 @@ stdenv.mkDerivation {
     "-DOPENCV_GENERATE_PKGCONFIG=ON"
     "-DWITH_OPENMP=ON"
     "-DBUILD_PROTOBUF=OFF"
-    "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe buildPackages.protobuf}"
+    "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe buildPackages.protobuf3_21}"
     "-DPROTOBUF_UPDATE_FILES=ON"
     "-DOPENCV_ENABLE_NONFREE=${printEnabled enableUnfree}"
     "-DBUILD_TESTS=${printEnabled runAccuracyTests}"
diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index 243d8830565d2..1bd8e63d37f9e 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.1.7";
+  version = "3.1.10";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    sha256 = "sha256-Kl+aOA797aZvrvW4ZQNHdSU7YFPieZEzX3aYeaoH6eU=";
+    sha256 = "sha256-8oV7Himk9AS2e2Z3OREE7KQgFIUysXwATlUN51dDe5M=";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 11121059500e8..277d3008bf2ac 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "openldap";
-  version = "2.6.5";
+  version = "2.6.6";
 
   src = fetchurl {
     url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${pname}-${version}.tgz";
-    hash = "sha256-Lieo1PTCr4/oQLVzJxwgqhY+JJh/l2UhRkQpD1vrONk=";
+    hash = "sha256-CC6ZjPVCmE1DY0RC2+EdqGB1nlEJBxUupXm9xC/jnqA=";
   };
 
   # TODO: separate "out" and "bin"
diff --git a/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch b/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch
deleted file mode 100644
index d1622977b64dc..0000000000000
--- a/pkgs/development/libraries/openssl/3.0/CVE-2023-2975.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc Mon Sep 17 00:00:00 2001
-From: Tomas Mraz <tomas@openssl.org>
-Date: Tue, 4 Jul 2023 17:30:35 +0200
-Subject: [PATCH] Do not ignore empty associated data with AES-SIV mode
-
-The AES-SIV mode allows for multiple associated data items
-authenticated separately with any of these being 0 length.
-
-The provided implementation ignores such empty associated data
-which is incorrect in regards to the RFC 5297 and is also
-a security issue because such empty associated data then become
-unauthenticated if an application expects to authenticate them.
-
-Fixes CVE-2023-2975
-
-Reviewed-by: Matt Caswell <matt@openssl.org>
-Reviewed-by: Paul Dale <pauli@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/21384)
-
-(cherry picked from commit c426c281cfc23ab182f7d7d7a35229e7db1494d9)
----
- .../implementations/ciphers/cipher_aes_siv.c   | 18 +++++++++++-------
- 1 file changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/providers/implementations/ciphers/cipher_aes_siv.c b/providers/implementations/ciphers/cipher_aes_siv.c
-index 45010b90db2a..b396c8651a32 100644
---- a/providers/implementations/ciphers/cipher_aes_siv.c
-+++ b/providers/implementations/ciphers/cipher_aes_siv.c
-@@ -120,14 +120,18 @@ static int siv_cipher(void *vctx, unsigned char *out, size_t *outl,
-     if (!ossl_prov_is_running())
-         return 0;
- 
--    if (inl == 0) {
--        *outl = 0;
--        return 1;
--    }
-+    /* Ignore just empty encryption/decryption call and not AAD. */
-+    if (out != NULL) {
-+        if (inl == 0) {
-+            if (outl != NULL)
-+                *outl = 0;
-+            return 1;
-+        }
- 
--    if (outsize < inl) {
--        ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
--        return 0;
-+        if (outsize < inl) {
-+            ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
-+            return 0;
-+        }
-     }
- 
-     if (ctx->hw->cipher(ctx, out, in, inl) <= 0)
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index fae2c5f1cc2f9..aaee6685cfc53 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -254,8 +254,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.9";
-    sha256 = "sha256-6xqwR4FHQ2D3fDGKuJ2MWgOrw45j1lpgPKu/GwCh3JA=";
+    version = "3.0.10";
+    sha256 = "sha256-F2HU9bE6ECi5tvPUuOF/6wztyTcPav5h1xk9LNzoMyM=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
@@ -263,9 +263,6 @@ in {
       # This patch disables build-time detection.
       ./3.0/openssl-disable-kernel-detection.patch
 
-      # https://www.openssl.org/news/secadv/20230714.txt
-      ./3.0/CVE-2023-2975.patch
-
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)
diff --git a/pkgs/development/libraries/protobuf/3.23.nix b/pkgs/development/libraries/protobuf/3.23.nix
new file mode 100644
index 0000000000000..2d658d57419ba
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/3.23.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic-v3-cmake.nix ({
+  version = "3.23.4";
+  sha256 = "sha256-eI+mrsZAOLEsdyTC3B+K+GjD3r16CmPx1KJ2KhCwFdg=";
+} // args)
diff --git a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
index dfe2a6d7a965d..384d2d0decb4c 100644
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
@@ -68,16 +68,17 @@ let
     ];
 
     buildInputs = [
-      abseil-cpp
       zlib
     ];
 
-    # After 3.20, CMakeLists.txt can now be found at the top-level, however
-    # a stub cmake/CMakeLists.txt still exists for compatibility with previous build assumptions
-    cmakeDir = "../cmake";
+    propagatedBuildInputs = [
+      abseil-cpp
+    ];
+
+    cmakeDir = if lib.versionOlder version "3.22" then "../cmake" else null;
     cmakeFlags = [
       "-Dprotobuf_ABSL_PROVIDER=package"
-      ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
+    ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
       "-Dprotobuf_BUILD_SHARED_LIBS=ON"
     ]
     # Tests fail to build on 32-bit platforms; fixed in 3.22
@@ -95,6 +96,8 @@ let
           protobuf = self;
         });
       };
+
+      inherit abseil-cpp;
     };
 
     meta = {
diff --git a/pkgs/development/libraries/protobufc/default.nix b/pkgs/development/libraries/protobufc/default.nix
index dc3b2c92f1913..d152512783f0e 100644
--- a/pkgs/development/libraries/protobufc/default.nix
+++ b/pkgs/development/libraries/protobufc/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoreconfHook
 , pkg-config
 , protobuf
@@ -11,28 +10,20 @@
 
 stdenv.mkDerivation rec {
   pname = "protobuf-c";
-  version = "1.4.1";
+  version = "unstable-2023-07-08";
 
   src = fetchFromGitHub {
     owner = "protobuf-c";
     repo = "protobuf-c";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-TJCLzxozuZ8ynrBQ2lKyk03N+QA/lbOwywUjDUdTlbM=";
+    rev = "fa86fddbd000316772d1deb5a8d1201fa7599ef7";
+    hash = "sha256-pmqZYFREPgSrWPekymTglhtAv6gQR1gP3dOl3hqjYig=";
   };
 
-  patches = [
-    # https://github.com/protobuf-c/protobuf-c/pull/534
-    (fetchpatch {
-      url = "https://github.com/protobuf-c/protobuf-c/commit/a6c9ea5207aeac61c57b446ddf5a6b68308881d8.patch";
-      hash = "sha256-wTb8+YbvrCrOVpgthI5SJdG/CpQcOzCX4Bv47FPY804=";
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [ protobuf zlib ];
 
-  PROTOC = lib.getExe buildPackages.protobuf;
+  env.PROTOC = lib.getExe buildPackages.protobuf;
 
   meta = with lib; {
     homepage = "https://github.com/protobuf-c/protobuf-c/";
diff --git a/pkgs/development/libraries/qt-5/5.15/qtwebengine-darwin-checks.patch b/pkgs/development/libraries/qt-5/5.15/qtwebengine-darwin-checks.patch
index 0d4154837829f..213fb624dab19 100644
--- a/pkgs/development/libraries/qt-5/5.15/qtwebengine-darwin-checks.patch
+++ b/pkgs/development/libraries/qt-5/5.15/qtwebengine-darwin-checks.patch
@@ -1,5 +1,5 @@
 diff --git a/configure.pri b/configure.pri
-index e072961f0..ac0861c01 100644
+index 3a33bdc82..c1460b8b5 100644
 --- a/configure.pri
 +++ b/configure.pri
 @@ -442,24 +442,6 @@ defineTest(qtwebengine_isWindowsPlatformSupported) {
@@ -24,6 +24,6 @@ index e072961f0..ac0861c01 100644
 -        qtwebengine_platformError("requires a macOS SDK version of 10.13 or newer. Current version is $${WEBENGINE_OSX_SDK_PRODUCT_VERSION}.")
 -        return(false)
 -    }
-     return(true)
- }
- 
+     CONFIG(debug, debug|release):isUniversal(){
+         qtwebengine_platformError("Universal builds can not be done with debug configuration due to large binary size.")
+         return(false)
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 20649c6f83a1d..f67f9d66da7ce 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,118 +1,118 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "e94b0fa39a2f4bf260969fb18bf075dba39b2df1",
-    "sha256": "0mc7rym5pngpwpjghih7afjlyvvrlpdzw1wrbggykpmm8vrk5hzv"
+    "rev": "01aa0a9cb22ce5ed2b7ead03ed9cbeb5f978e897",
+    "sha256": "0r1bicsjn4addsf0cw2vkf26kxlf8z1fh65w19gnqmcwkrr8hnja"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "38635c3b343ce30b71e44c5a59f2f7393fba8259",
-    "sha256": "010jh2vdlymaxs1wd0agzb2gvgms9xrhs4vb5bjiiq5pys1sgkbp"
+    "rev": "7a04a93e97390de2d91e89dc907e8240dd5a0c4f",
+    "sha256": "1bqy5cmimnlmgd02zpv0ipf74nx350fk0d4pm2j4pqipq1spq3bh"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "b458aee3f907f2ce1880ad4031abecb2a1eab90a",
-    "sha256": "14vn9k80ilc2smaflnamyg5k0ddj3n4m123yfwb79rfg3lddhvs5"
+    "rev": "1170e17043ff51590ccee30447bef1e43a999b0d",
+    "sha256": "0qhlhz7ng35mb5pmva9ivpxq1ib30dz8f1p93yil78cyl9mwqbbi"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "a196623892558623e467f20b67edb78794252a09",
-    "sha256": "0yna2k1w595xwh9bk268h31fjl2ff8cm185dmm0v5gr4w8h9yr4g"
+    "rev": "e24dc54b2b4054413650904288aa7a363eee23a7",
+    "sha256": "0gpg0avl06jbamgk5f9034cfqwyifgv4nyqx49rp0r9wm2m1cgxb"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "3d4a84eb6d62ce22a47794f309f9268729ac375f",
-    "sha256": "047hl5hd0l337b7bsc28lfx9p9jbrnqswfdk80ndvgvp96ziblg5"
+    "rev": "7ce22b0633eb9d1eb59854fee4f2f545e1b842e0",
+    "sha256": "0q173ql5xyacwb5lwyrzhgch1bbjq4mmsfwhyssm3a9phqcj083m"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "e6d37133affc71451129d84790c6c22227e64aff",
-    "sha256": "1bc1d0h2f1q0xfvr8p5fq1580bl8cs0qhdncm600v590z56cyika"
+    "rev": "eeaf42bccd49e8161fbae82d110026d25a5a9a7f",
+    "sha256": "0daa72yizb6v28bci72fw1w8y8al0mhb9k7kxn7vg22fbb3iyksf"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "7636478bb30f0af8afe9af429eb8512d6fbcc11b",
-    "sha256": "08xkhxwp5mlcp4q45adqn58p37wn2z2zabw23f51qvfw8rir9g62"
+    "rev": "d366b0aad8454355acac79eddbab445c1108b1e9",
+    "sha256": "15ad1cbfdwnl6lnafgd4chdsl9wnwfcqqnd2m0dwj10n2lsa3nmw"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "039ce261b0f8061f8485f9c2eaf497a4d4395baa",
-    "sha256": "1kp2pnwfcwsxhy2w1sdg722d0kb1i6kx3a9r42gl1i9d73k8afi2"
+    "rev": "3e98cdb2780d052fce3d7a3694596a690cd76aca",
+    "sha256": "15fn0zjfz7jnjgc7m368sna2mvhcp33r85r2kwc9hy7zkp1is6a1"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "701325d57940c6e54353d0d4b6c3ebac6f9688a3",
-    "sha256": "01x2075d71z3ag99dppixs1y85zrr0vck0piah62l9n0v3wz4r6p"
+    "rev": "9dfbbfb9971db22d51eb40d6636583df5913be01",
+    "sha256": "1l192k1w5mjw14zq3h3pjb3m0zl56fhgxdjfxhmbncjx0ym98wzr"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "7c05744e38d44afac687df3349d548c8790837db",
-    "sha256": "0j8rak512f96i0wy4n0d4fjsgfzn283k2kfpn93d2blld4r2rd5s"
+    "rev": "f90bd729eb70d4a0770efed3f9bb1b6dbe67d37c",
+    "sha256": "1vbfmyb51lv3ms0iyizi05jiba688scjwxwvyrr8qnmg4qrjqjd5"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "06cfcbb6940d2729f5a6575e264873ce65ac99c3",
-    "sha256": "02jc7q7ijmhmffdp2ql2j3fw8ag7q98xlq40pywmzgrf1ggb34sw"
+    "rev": "500ae59f809877e0ada9a68601564882f2733145",
+    "sha256": "0p8vxp5l7iihd1xww94asnb9xv2v94p9whqbljzn6gwr56wvys5l"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "c249f58541afa45955c23b75c1fb88c5e3e4d18b",
-    "sha256": "025fxiy6ahgfqw3w7a08r2ff4ry2m1qn65haimpnn6bmi4vp88m8"
+    "rev": "5aa33ec870977863c400103db94da452edbaf414",
+    "sha256": "02i3ns2ijiiy0jfad3lxrvvlr38bgarl8246ka0y8aa8by1ih35b"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "30fb93cf8521f2c0b3803903153d9034b7d7bcc2",
-    "sha256": "1b027hfc1m2nz0v906w08srmpyci3362arxc18cin334yhgghbx1"
+    "rev": "664701dc3acfca37500bc84ba03eed4953b684e9",
+    "sha256": "0nlzjksfzkjhla89warkj7c5h8z2h5ivnhnq1sw2385gfd4q5d8w"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "f9f123a97989638c36b5c2b03f4ff6261ddaed9a",
-    "sha256": "06b5rjzqd1630c87spldxxd0bvkb94sbnaxwxbi7ac74k35ydq7s"
+    "rev": "f65b6a268832fc86e1263a6597f2e369aefecd19",
+    "sha256": "157in9bvnd9q2jigrrl955y7d2gpj308g8mg7k19r1vaz6h4zlm7"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "209e3ddcf0a6b48ff47a7dc97f2ea38470c8780d",
-    "sha256": "09aipbnalb44w6g3kzm9dc84ls2xmp1clwmy5zd012xsvjwqd3h5"
+    "rev": "ca5e5fdca44e8e56dafaac2a5bd886cad2a5c0f5",
+    "sha256": "1yrk7kj5dvfcha8w0abvh8xfjn6nbl4njm1r2h2776l3sf46xd4c"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "ff4c7bc3bf7ba4b748fdeb9d09887271c2b28505",
-    "sha256": "14wx49mkqqzvwzhbx3jhbrjngq4vb3x2kmgzrq7f6nri0g7dpss8"
+    "rev": "78d05cfcec57a9e890cb5ddbea604f194e04315d",
+    "sha256": "1vf0gmf6bh3hadrrk0922dbagmvxi1il3pjiyhmz087bm80km1md"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "59311ee7d78a8b19d3dbe61cf49d42c5bd7c934a",
-    "sha256": "1rdgfmfsqp3hdkkq6bi8vdxgrh45xzf1b2nryhnk8pid81wa2bzq"
+    "rev": "a0f23c6a1f11bd7c6a8e4fd34f10bdb0a35789fa",
+    "sha256": "0sy2s7xnq2xmqm3lcp439wn6zk6znzja489gh531mmkaj13kiqa9"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "5737c10128c6eeb28c10df569c8492bb2e8f4230",
-    "sha256": "0iny9npc7w7b1rz9yx659bva66rllhbfqh4af9wdwbi9ssr4x5pc"
+    "rev": "a3e675872e4b323f89b94b90b66caa945b576b2e",
+    "sha256": "0b6da91fja6w3mphsfydp0plcwmk8nywhd5v8irgc98v1hw114dg"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "ccd0284235e9e3e1f97d808125af5024d3f04140",
-    "sha256": "1mfw97v60fdszab0gqxjydw00f89rx8clw3dq72zx1rgv8rn2s67"
+    "rev": "353f50a9851518eb637181c00302cd354e0ae98b",
+    "sha256": "1y269yamhlf46rwcvwzhdqhajyqj41xxf9x0l1nrcr4n07l4mbr8"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "eb9dead185ae209dd2364d09db74d8ab613d982d",
-    "sha256": "1pza9cjv49x59lvzyv45hwz01z8l9zzn8a3ssazycxvcq3w0pncb"
+    "rev": "0ea7cfdfbfa72d467fe542cc48ab3206c177a387",
+    "sha256": "1bvg32cz4x00j9333yas7cmfzx8rlhika4a9vwdikrr5a64awsl9"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "68a48018e34322edaf611639710b3edbe389e8c2",
-    "sha256": "04hswsamjmwgn63gs3rhxygvwjfqx5f0qifzp3gp6q4fw8lkgwpf"
+    "rev": "0472a07a8f39587052216d85a7ed235c531eba2c",
+    "sha256": "1psal4kldwbhfgg0b234dhgm30s5q83g2krcik1p4sifrzgrry3r"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "dd5d4af65890baad8baa85a445a752a877a4f7e3",
-    "sha256": "1m096pskaxhzxyvz17lksg1qlni7qacvqf3z71wvwvxzgjvs5bqh"
+    "rev": "4956b556ccb021e4691f314ab907ea2ebb1ca8a6",
+    "sha256": "0d6w36pvnk616ps7k1ykpk2ahcvn746svwmv3dxvf4capfij96rj"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "27b496d5aff650e4cf9a3148857c723dce10ef25",
-    "sha256": "0wyf1nb6wjh4jd2n8cng7a6lzv1dkwrniabsvn1adl1nqknq7asv"
+    "rev": "d10e7673218fa2b00191a82ad20cd3304a711fa6",
+    "sha256": "0z5dzgdr92yw3y5vx6l9r9kz81r0vvwi264la9r7j20jqb75i2a5"
   },
   "qtscript": {
     "url": "https://invent.kde.org/qt/qt/qtscript.git",
@@ -121,87 +121,87 @@
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "d30a77111835395828fdcaa89a88110c5d9f6857",
-    "sha256": "1yid5653653qlpk305y276gdrifdxpjzfa1629csq2b8hpwkddc2"
+    "rev": "7f276be586be79d41213a8dd05ef31144313d440",
+    "sha256": "0yiryqzs44nx5lg54gbs7gf5n2d5chybya71kcv0iwn48dbzy33n"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "391c710b88865a3e0311b61d93fcdbbfd6996d46",
-    "sha256": "19myf3w6g64clj9msy71is7b9krkfrzcqlyza37m3pimy7x305a0"
+    "rev": "45c04582b15a9bb4be01ae99aa7fda1bbba7d0df",
+    "sha256": "0wp9ddna0zidl18707nrqsg8sybaggam0hmm9yxyyfnsr39wms4m"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "f8684ae6b0c12b6b21f1547fabe38b60c39f8893",
-    "sha256": "0k60wibb2xis7gvx9d7q14a3sq1ij1m196ax4rfwwrzsz2vviir0"
+    "rev": "b3081c36baee48b43b6285b4811dc6da451e2390",
+    "sha256": "167bmp5wrp9mflvzhgc2am9nnyw1vb58skdxjn7ag8jq88fhv0zz"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "7fb308ec721f034a0d673784d951577d764a8e67",
-    "sha256": "1f8sjyd7ksy4420lr6vn18mzb64jm0p8mml5d2vpgp344w2jbqm0"
+    "rev": "af58a4c62415fbfd997c43422acf93e2e6ab5155",
+    "sha256": "1ihjj7gqjy75ccf4qniilddyiknjklc88mxns6sy8wz3ymr58vfh"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "4856b6e231d7e2373ec8f89e861603a0d815793a",
-    "sha256": "0v8lx6g43apfnyn37ccgjnq7abayplgnihx62fncgl2cpmy9nkha"
+    "rev": "75142c77cda8ef3a5c1cae69863e963797c667b5",
+    "sha256": "0iaw13vx80yfcchkmrmp6n79i0i6b9rv7k69xxp3wb3l5d3n0ng0"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "837b5163e17edbd3a9f098e9a1ab73febab419b4",
-    "sha256": "082i9q36d44g5a3jbw3ahvmmxikfai50wd2yq8xvkh8kr8xr7n5z"
+    "rev": "37b2c764fb599c96fc415049208e871c729217c8",
+    "sha256": "11h0n9k6l4r97x6h1m09nzsblwmmkkj46nl80dnvjimb395d71ri"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "5649efd376ed7dbb171905e9edebbd547d1f73eb",
-    "sha256": "1c49v7pni6bljnf4ppxrrdr0h0hpw4i7s6an91m7ca18s8x4m1rb"
+    "rev": "9f7af2d08eea7c2a2a2bfe7e6a9b73d1b99f5123",
+    "sha256": "1vb6s9zy8nw6gd0kmk77bjvxwpnfbhaifrznp019zccckibzffsg"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "2b802231af3eb21c3c781753aba804217f855e86",
-    "sha256": "1xdp1x6qkdm0xz8yg1j2c1fpav54c1rwxlpfj116xspfik4zy7gf"
+    "rev": "a680686754d84b91d4cc4252a2fb8af0c58f5f49",
+    "sha256": "1i92mk6f2ldwq12qa4wnlz52zya4nlpjm3r2vy95vkj69xi2bfk3"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "4191fd9098ae25ffd5917370427460842e73f0cb",
-    "sha256": "0jl9dw1azh961hcakmyxavfm0w7g1a89lyj2bal8dqvv9y3089cj"
+    "rev": "72373522141dd3206183eb5fa56ae1c36a6d4c2b",
+    "sha256": "1ndgy8jxn9f7dwg9kydhlbll20qdivfbvdlcxk8qpzilpccd2l3z"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "c4c3fc69250c01cb35aaae5ea1ea2bcc8236dff0",
-    "sha256": "040wgrxr2kkshpyg3gwcggdxlxrjd7pbnr3fj8v63byx34sz2w9b"
+    "rev": "d4f650b6c29c621c58bc7b7e7c9ddcbbbc72e3b4",
+    "sha256": "11xqpj36mfyfhcip89i82dyclbkvs77byffax2kscv1kdj3x7w2l"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "c508ffb1996eeddfd10dda493974746e6b375080",
-    "sha256": "0hs7cqfiwc0mdsa9zngackfljy7d5306mpn3rwjfi5rawd85xsp0"
+    "rev": "74c0625337c8a8de0a465878c7e7d238e8d979ed",
+    "sha256": "0yz2sg8k3l88ngsgyfb6cljh8x5sicww59m447xk7yngxgyaj75m"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "64beacdd2d0f6fe0796bd291c9ab33f206a333c3",
-    "sha256": "1vqmxkfzggsalq2ic2b902jy0b47zkgzl95gg8dia8089vfny4kn"
+    "rev": "13202e8a8c0c6d39026344b5a19a0148592160bc",
+    "sha256": "0gki7hc3684qhqbq7i4wa3w7szy3j6af0yfd50q2mxb1lbxjsdrx"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "ed7416b1b8af9de9926388408469a35f2ad6a795",
-    "sha256": "1434bqqb1hm49b1acwb22b2lc9p936dlylg0m56h2pl4vv9w0v3b"
+    "rev": "89fbe461e7091ae6a4689b7791293a06c9167776",
+    "sha256": "15vkh80rma5l9mrmg41vhxvqxlzqjzl8x20k33xm11lw2kjsszm5"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "23d67d0de3301dbed5d8c5880b6cf60bfa9eeb2a",
-    "sha256": "16rqz6jiiswaiwa7hn6pn0cq9la8843b4jxi8di30ymq9ysivbqq"
+    "rev": "7e941648610ff4033ae8f9709077edd0595364f0",
+    "sha256": "082w4r674fq7ks5jbh3pj3xb3sqlhn4giy7fy0h3vw170lmcqz0m"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "44d18eaff83b7491a130e41678cadcc3ba836a8d",
-    "sha256": "10fky86gcma9fwdbk3s733x7gqgxzsg6iaf9j42b0f8c2n5jhql3"
+    "rev": "5afc77f5347113b607ca0262505f3406e1be5bf4",
+    "sha256": "1a7dm0dxqq817pib1y6m0f09sc2cqd1qkfb9anznsgpmzynvfp6r"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "8bba77a558049727d1bc88736dd03d1b5c41cead",
-    "sha256": "1lk4jm2pp0n8disxpcr1520bd798lif23fisnmkzysxcrlw1dflh"
+    "rev": "74f81f0bfe17e5aabcebafcb0cf36f739133554c",
+    "sha256": "1akp4mwvfspxdq5akpyphf6p3ay0z9pzaigiiy198w9q0yvrkgl7"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "fa0c41677ab43bc50bc4d086dfce96602060b7e0",
-    "sha256": "1wrh1m9s4pdbvlgy93jv6acn9k1an6jb086cbxscgimgw3kb867p"
+    "rev": "0c1dcfe344c03d48d753aeb58f139bc990f2611c",
+    "sha256": "1cab7y9asivdg9ypwc951pczf4ddgni60l1ajlfsprk48rypr7w1"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index d47f9705d2124..6729c7c31af3b 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -1,8 +1,10 @@
 { lib, fetchgit, fetchFromGitHub }:
 
 let
-  version = "5.15.9";
-  overrides = {};
+  version = "5.15.10";
+  overrides = {
+    qtscript.version = "5.15.9";
+  };
 
   mk = name: args:
     let
@@ -74,37 +76,15 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
     hash = "sha256-LPfBCEB5tJOljXpptsNk0sHGtJf/wIRL7fccN79Nh6o=";
   };
 
-  qtwebengine =
-    let
-      branchName = "5.15.13";
-      rev = "v${branchName}-lts";
-    in
-    {
-      version = branchName;
+  qtwebengine = rec {
+      version = "5.15.14";
 
-      src = fetchgit {
-        url = "https://github.com/qt/qtwebengine.git";
-        sha256 = "sha256-gZmhJTA5A3+GeySJoppYGffNC6Ych2pOYlsu3w+fnmw=";
-        inherit rev branchName;
+      src = fetchFromGitHub {
+        owner = "qt";
+        repo = "qtwebengine";
+        rev = "v${version}-lts";
+        hash = "sha256-jIoNwRdr0bZ2p0UMp/KDQuwgNjhzzGlb91UGjQgT60Y=";
         fetchSubmodules = true;
-        leaveDotGit = true;
-        name = "qtwebengine-${lib.substring 0 8 rev}.tar.gz";
-        postFetch = ''
-          # remove submodule .git directory
-          rm -rf "$out/src/3rdparty/.git"
-
-          # compress to not exceed the 2GB output limit
-          # try to make a deterministic tarball
-          tar -I 'gzip -n' \
-            --sort=name \
-            --mtime=1970-01-01 \
-            --owner=root --group=root \
-            --numeric-owner --mode=go=rX,u+rw,a-s \
-            --transform='s@^@source/@' \
-            -cf temp  -C "$out" .
-          rm -r "$out"
-          mv temp "$out"
-        '';
       };
     };
 }
diff --git a/pkgs/development/libraries/tix/default.nix b/pkgs/development/libraries/tix/default.nix
index 80b93823df946..a46b2499964c3 100644
--- a/pkgs/development/libraries/tix/default.nix
+++ b/pkgs/development/libraries/tix/default.nix
@@ -21,6 +21,9 @@ tcl.mkTclDerivation {
     })
     # Remove duplicated definition of XLowerWindow
     ./duplicated-xlowerwindow.patch
+    # Fix incompatible function pointer conversions and implicit definition of `panic`.
+    # `panic` is just `Tcl_Panic`, but it is not defined on Darwin due to a conflict with `mach/mach.h`.
+    ./fix-clang16.patch
   ] ++ lib.optional (tcl.release == "8.6")
   (fetchpatch {
     name = "tix-8.4.3-tcl8.6.patch";
diff --git a/pkgs/development/libraries/tix/fix-clang16.patch b/pkgs/development/libraries/tix/fix-clang16.patch
new file mode 100644
index 0000000000000..f5d8a5337de07
--- /dev/null
+++ b/pkgs/development/libraries/tix/fix-clang16.patch
@@ -0,0 +1,215 @@
+diff -ur a/generic/tixDItem.c b/generic/tixDItem.c
+--- a/generic/tixDItem.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixDItem.c	2023-07-11 14:49:51.583894242 -0600
+@@ -30,7 +30,7 @@
+ 		Tcl_Interp *interp, Tk_Window tkwin, CONST84 char *value,
+ 		char *widRec, int offset));
+ 
+-static char *DItemPrintProc _ANSI_ARGS_((
++static const char *DItemPrintProc _ANSI_ARGS_((
+ 		ClientData clientData, Tk_Window tkwin, char *widRec,
+ 		int offset, Tcl_FreeProc **freeProcPtr));
+ 
+@@ -548,7 +548,7 @@
+     return TCL_OK;
+ }
+ 
+-static char *DItemPrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
++static const char *DItemPrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
+     ClientData clientData;
+     Tk_Window tkwin;
+     char *widRec;
+diff -ur a/generic/tixDiStyle.c b/generic/tixDiStyle.c
+--- a/generic/tixDiStyle.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixDiStyle.c	2023-07-11 15:02:45.245210252 -0600
+@@ -31,7 +31,7 @@
+ static int   		DItemStyleParseProc _ANSI_ARGS_((ClientData clientData,
+ 			    Tcl_Interp *interp, Tk_Window tkwin,
+ 			    CONST84 char *value,char *widRec, int offset));
+-static char *		DItemStylePrintProc _ANSI_ARGS_((
++static const char *		DItemStylePrintProc _ANSI_ARGS_((
+ 			    ClientData clientData, Tk_Window tkwin, 
+ 			    char *widRec, int offset,
+ 			    Tcl_FreeProc **freeProcPtr));
+@@ -785,7 +785,7 @@
+ 
+     hashPtr = Tcl_CreateHashEntry(&stylePtr->base.items, (char*)iPtr, &isNew);
+     if (!isNew) {
+-	panic("DItem is already associated with style");
++	Tcl_Panic("DItem is already associated with style");
+     } else {
+ 	Tcl_SetHashValue(hashPtr, (char*)iPtr);
+     }
+@@ -801,7 +801,7 @@
+ 
+     hashPtr = Tcl_FindHashEntry(&stylePtr->base.items, (char*)iPtr);
+     if (hashPtr == NULL) {
+-	panic("DItem is not associated with style");
++	Tcl_Panic("DItem is not associated with style");
+     }
+     Tcl_DeleteHashEntry(hashPtr);
+     stylePtr->base.refCount--;
+@@ -998,7 +998,7 @@
+     return TCL_ERROR;
+ }
+ 
+-static char *DItemStylePrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
++static const char *DItemStylePrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
+     ClientData clientData;
+     Tk_Window tkwin;
+     char *widRec;
+diff -ur a/generic/tixForm.c b/generic/tixForm.c
+--- a/generic/tixForm.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixForm.c	2023-07-11 14:53:45.695753419 -0600
+@@ -802,7 +802,7 @@
+      * Now set all the client's geometry
+      */
+     if (PlaceAllClients(masterPtr) != TCL_OK) {
+-	panic("circular dependency");
++	Tcl_Panic("circular dependency");
+     }
+ 
+     for (clientPtr = masterPtr->client; clientPtr; clientPtr=clientPtr->next) {
+diff -ur a/generic/tixGrData.c b/generic/tixGrData.c
+--- a/generic/tixGrData.c	2004-03-27 19:44:56.000000000 -0700
++++ b/generic/tixGrData.c	2023-07-11 14:54:19.644741199 -0600
+@@ -296,7 +296,7 @@
+ 	Tcl_DeleteHashEntry(cy);
+     }
+     else {
+-	panic("Inconsistent grid dataset: (%d,%d) : %x %x", x, y, cx, cy);
++	Tcl_Panic("Inconsistent grid dataset: (%d,%d) : %x %x", x, y, cx, cy);
+     }
+ 
+     return 1;
+diff -ur a/generic/tixGrid.c b/generic/tixGrid.c
+--- a/generic/tixGrid.c	2008-02-27 21:10:43.000000000 -0700
++++ b/generic/tixGrid.c	2023-07-11 14:53:59.283841038 -0600
+@@ -831,7 +831,7 @@
+ 	 * All mapped windows should have been unmapped when the
+ 	 * the entries were deleted
+ 	 */
+-	panic("tixGrid: mappedWindows not NULL");
++	Tcl_Panic("tixGrid: mappedWindows not NULL");
+     }
+ 
+     Tk_FreeOptions(configSpecs, (char *) wPtr, wPtr->dispData.display, 0);
+diff -ur a/generic/tixHList.c b/generic/tixHList.c
+--- a/generic/tixHList.c	2008-02-27 21:05:29.000000000 -0700
++++ b/generic/tixHList.c	2023-07-11 14:55:20.699375202 -0600
+@@ -2036,7 +2036,7 @@
+ 	    break;
+ 	}
+ 	if (wPtr->headerWin != NULL) {
+-	    panic("HList: header subwindow deleted illegally\n");
++	    Tcl_Panic("HList: header subwindow deleted illegally\n");
+ 	}
+ #endif
+ 	break;
+@@ -2117,7 +2117,7 @@
+ 	 * All mapped windows should have been unmapped when the
+ 	 * the entries were deleted
+ 	 */
+-	panic("tixHList: mappedWindows not NULL");
++	Tcl_Panic("tixHList: mappedWindows not NULL");
+     }
+     if (wPtr->headerWin) {
+ 	wPtr->headerWin = NULL;
+diff -ur a/generic/tixImgCmp.c b/generic/tixImgCmp.c
+--- a/generic/tixImgCmp.c	2008-02-27 21:05:29.000000000 -0700
++++ b/generic/tixImgCmp.c	2023-07-11 14:59:16.429640785 -0600
+@@ -142,8 +142,8 @@
+  * The type record for bitmap images:
+  */
+ static int		ImgCmpCreate _ANSI_ARGS_((Tcl_Interp *interp,
+-			    char *name, int argc, Tcl_Obj *CONST objv[],
+-			    Tk_ImageType *typePtr, Tk_ImageMaster master,
++			    const char *name, int argc, Tcl_Obj *CONST objv[],
++			    const Tk_ImageType *typePtr, Tk_ImageMaster master,
+ 			    ClientData *clientDataPtr));
+ static ClientData	ImgCmpGet _ANSI_ARGS_((Tk_Window tkwin,
+ 			    ClientData clientData));
+@@ -378,11 +378,11 @@
+ ImgCmpCreate(interp, name, argc, objv, typePtr, master, clientDataPtr)
+     Tcl_Interp *interp;		/* Interpreter for application containing
+ 				 * image. */
+-    char *name;			/* Name to use for image. */
++    const char *name;		/* Name to use for image. */
+     int argc;			/* Number of arguments. */
+     Tcl_Obj *CONST objv[];	/* Argument strings for options (doesn't
+ 				 * include image name or type). */
+-    Tk_ImageType *typePtr;	/* Pointer to our type record (not used). */
++    const Tk_ImageType *typePtr;/* Pointer to our type record (not used). */
+     Tk_ImageMaster master;	/* Token for image, to be used by us in
+ 				 * later callbacks. */
+     ClientData *clientDataPtr;	/* Store manager's token for image here;
+diff -ur a/generic/tixImgXpm.c b/generic/tixImgXpm.c
+--- a/generic/tixImgXpm.c	2023-07-11 15:01:05.887387236 -0600
++++ b/generic/tixImgXpm.c	2023-07-11 15:00:37.209042328 -0600
+@@ -22,8 +22,8 @@
+  */
+ 
+ static int		ImgXpmCreate _ANSI_ARGS_((Tcl_Interp *interp,
+-			    char *name, int argc, Tcl_Obj *CONST objv[],
+-			    Tk_ImageType *typePtr, Tk_ImageMaster master,
++			    const char *name, int argc, Tcl_Obj *CONST objv[],
++			    const Tk_ImageType *typePtr, Tk_ImageMaster master,
+ 			    ClientData *clientDataPtr));
+ static ClientData	ImgXpmGet _ANSI_ARGS_((Tk_Window tkwin,
+ 			    ClientData clientData));
+@@ -115,11 +115,11 @@
+ ImgXpmCreate(interp, name, argc, objv, typePtr, master, clientDataPtr)
+     Tcl_Interp *interp;		/* Interpreter for application containing
+ 				 * image. */
+-    char *name;			/* Name to use for image. */
++    const char *name;		/* Name to use for image. */
+     int argc;			/* Number of arguments. */
+     Tcl_Obj *CONST objv[];	/* Argument strings for options (doesn't
+ 				 * include image name or type). */
+-    Tk_ImageType *typePtr;	/* Pointer to our type record (not used). */
++    const Tk_ImageType *typePtr;/* Pointer to our type record (not used). */
+     Tk_ImageMaster master;	/* Token for image, to be used by us in
+ 				 * later callbacks. */
+     ClientData *clientDataPtr;	/* Store manager's token for image here;
+@@ -1213,7 +1213,7 @@
+     PixmapMaster *masterPtr = (PixmapMaster *) masterData;
+ 
+     if (masterPtr->instancePtr != NULL) {
+-	panic("tried to delete pixmap image when instances still exist");
++	Tcl_Panic("tried to delete pixmap image when instances still exist");
+     }
+     masterPtr->tkMaster = NULL;
+     if (masterPtr->imageCmd != NULL) {
+diff -ur a/generic/tixTList.c b/generic/tixTList.c
+--- a/generic/tixTList.c	2008-02-27 21:05:29.000000000 -0700
++++ b/generic/tixTList.c	2023-07-11 14:55:35.960761327 -0600
+@@ -1208,7 +1208,7 @@
+ 	    sprintf(buff, "%d", i);
+ 	    Tcl_AppendResult(interp, buff, NULL);
+ 	} else {
+-	    panic("TList list entry is invalid");
++	    Tcl_Panic("TList list entry is invalid");
+ 	}
+     } else {
+ 	Tcl_ResetResult(interp);
+diff -ur a/generic/tixUtils.c b/generic/tixUtils.c
+--- a/generic/tixUtils.c	2008-02-27 21:29:17.000000000 -0700
++++ b/generic/tixUtils.c	2023-07-11 15:01:43.718202631 -0600
+@@ -24,7 +24,7 @@
+ static int	ReliefParseProc(ClientData clientData,
+ 	Tcl_Interp *interp, Tk_Window tkwin, CONST84 char *value,
+ 	char *widRec, int offset);
+-static char *	ReliefPrintProc(ClientData clientData,
++static const char *	ReliefPrintProc(ClientData clientData,
+ 	Tk_Window tkwin, char *widRec, int offset,
+ 	Tix_FreeProc **freeProcPtr);
+ 
+@@ -637,7 +637,7 @@
+     return TCL_ERROR;
+ }
+ 
+-static char *
++static const char *
+ ReliefPrintProc(clientData, tkwin, widRec,offset, freeProcPtr)
+     ClientData clientData;
+     Tk_Window tkwin;
diff --git a/pkgs/development/libraries/umockdev/default.nix b/pkgs/development/libraries/umockdev/default.nix
index cb1a8dccffd18..1cae2c62b33c0 100644
--- a/pkgs/development/libraries/umockdev/default.nix
+++ b/pkgs/development/libraries/umockdev/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "umockdev";
-  version = "0.17.17";
+  version = "0.17.18";
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://github.com/martinpitt/umockdev/releases/download/${finalAttrs.version}/umockdev-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-IOYhseRYsyADz+qZc5tngkuGZShUqLzjPiYSTjR/32w=";
+    sha256 = "sha256-RmrT4McV5W9Q6mqWUWWCPQc6hBN6y4oeObZlc2SKmF8=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/webp-pixbuf-loader/default.nix b/pkgs/development/libraries/webp-pixbuf-loader/default.nix
index bf2c8c28dbdbe..1f36ffc1c666b 100644
--- a/pkgs/development/libraries/webp-pixbuf-loader/default.nix
+++ b/pkgs/development/libraries/webp-pixbuf-loader/default.nix
@@ -11,10 +11,7 @@
 
 let
   inherit (gdk-pixbuf) moduleDir;
-
-  # turning lib/gdk-pixbuf-#.#/#.#.#/loaders into lib/gdk-pixbuf-#.#/#.#.#/loaders.cache
-  # removeSuffix is just in case moduleDir gets a trailing slash
-  loadersPath = (lib.strings.removeSuffix "/" gdk-pixbuf.moduleDir) + ".cache";
+  loadersPath = "${gdk-pixbuf.binaryDir}/webp-loaders.cache";
 in
 stdenv.mkDerivation rec {
   pname = "webp-pixbuf-loader";
@@ -47,7 +44,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     # It looks for gdk-pixbuf-thumbnailer in this package's bin rather than the gdk-pixbuf bin. We need to patch that.
     substituteInPlace webp-pixbuf.thumbnailer.in \
-      --replace "@bindir@/gdk-pixbuf-thumbnailer" "$out/bin/webp-thumbnailer"
+      --replace "@bindir@/gdk-pixbuf-thumbnailer" "$out/libexec/gdk-pixbuf-thumbnailer-webp"
   '';
 
   postInstall = ''
@@ -58,7 +55,7 @@ stdenv.mkDerivation rec {
     # It assumes gdk-pixbuf-thumbnailer can find the webp loader in the loaders.cache referenced by environment variable, breaking containment.
     # So we replace it with a wrapped executable.
     mkdir -p "$out/bin"
-    makeWrapper "${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer" "$out/bin/webp-thumbnailer" \
+    makeWrapper "${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer" "$out/libexec/gdk-pixbuf-thumbnailer-webp" \
       --set GDK_PIXBUF_MODULE_FILE "$out/${loadersPath}"
   '';
 
diff --git a/pkgs/development/python-modules/adguardhome/default.nix b/pkgs/development/python-modules/adguardhome/default.nix
index 28af1269c180f..5c32d588428f8 100644
--- a/pkgs/development/python-modules/adguardhome/default.nix
+++ b/pkgs/development/python-modules/adguardhome/default.nix
@@ -42,6 +42,8 @@ buildPythonPackage rec {
     yarl
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-client/default.nix b/pkgs/development/python-modules/aio-geojson-client/default.nix
index ad0a641c35f5d..22c59bd64d9d8 100644
--- a/pkgs/development/python-modules/aio-geojson-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-client/default.nix
@@ -31,6 +31,8 @@ buildPythonPackage rec {
     haversine
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     mock
diff --git a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
index 56e5f8475cbc4..4ff502a2cf83a 100644
--- a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix b/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
index 90645327c046a..f8daf10c3c1fa 100644
--- a/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix b/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
index fed8b6374a7ea..d97070df5907a 100644
--- a/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
@@ -31,6 +31,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     mock
diff --git a/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix b/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
index b7c205179fd76..bf18c2bf184b6 100644
--- a/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
index 1cb1125839354..89a1fd75b8f26 100644
--- a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytz
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/aio-georss-client/default.nix b/pkgs/development/python-modules/aio-georss-client/default.nix
index 6fb1ec42631bc..9c3cda759039a 100644
--- a/pkgs/development/python-modules/aio-georss-client/default.nix
+++ b/pkgs/development/python-modules/aio-georss-client/default.nix
@@ -35,6 +35,8 @@ buildPythonPackage rec {
     dateparser
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     mock
diff --git a/pkgs/development/python-modules/aio-georss-gdacs/default.nix b/pkgs/development/python-modules/aio-georss-gdacs/default.nix
index 3816b591544da..f55a42b5dd227 100644
--- a/pkgs/development/python-modules/aio-georss-gdacs/default.nix
+++ b/pkgs/development/python-modules/aio-georss-gdacs/default.nix
@@ -28,6 +28,8 @@ buildPythonPackage rec {
     dateparser
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
diff --git a/pkgs/development/python-modules/aiohttp-retry/default.nix b/pkgs/development/python-modules/aiohttp-retry/default.nix
index bf3c251b4fb84..262fcef8e442b 100644
--- a/pkgs/development/python-modules/aiohttp-retry/default.nix
+++ b/pkgs/development/python-modules/aiohttp-retry/default.nix
@@ -25,6 +25,8 @@ buildPythonPackage rec {
     aiohttp
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-aiohttp
     pytestCheckHook
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index e2e2ebac9ae5f..b988abe60108f 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -6,6 +6,7 @@
 , pythonOlder
 # build_requires
 , setuptools
+, wheel
 # install_requires
 , attrs
 , charset-normalizer
@@ -49,6 +50,8 @@ buildPythonPackage rec {
       url = "https://github.com/aio-libs/aiohttp/commit/7dcc235cafe0c4521bbbf92f76aecc82fee33e8b.patch";
       hash = "sha256-ZzhlE50bmA+e2XX2RH1FuWQHZIAa6Dk/hZjxPoX5t4g=";
     })
+    # https://github.com/aio-libs/aiohttp/pull/7454 but does not merge cleanly
+    ./setuptools-67.5.0-compatibility.diff
   ];
 
   postPatch = ''
@@ -57,6 +60,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff b/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff
new file mode 100644
index 0000000000000..2f75b6b4c1363
--- /dev/null
+++ b/pkgs/development/python-modules/aiohttp/setuptools-67.5.0-compatibility.diff
@@ -0,0 +1,27 @@
+diff --git a/setup.cfg b/setup.cfg
+index 6944b7e2..dfa65d69 100644
+--- a/setup.cfg
++++ b/setup.cfg
+@@ -128,6 +128,7 @@ filterwarnings =
+ 	ignore:Creating a LegacyVersion has been deprecated and will be removed in the next major release:DeprecationWarning::
+ 	ignore:module 'sre_constants' is deprecated:DeprecationWarning:pkg_resources._vendor.pyparsing
+ 	ignore:path is deprecated. Use files.. instead. Refer to https.//importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy for migration advice.:DeprecationWarning:certifi.core
++	ignore:pkg_resources is deprecated as an API:DeprecationWarning
+ junit_suite_name = aiohttp_test_suite
+ norecursedirs = dist docs build .tox .eggs
+ minversion = 3.8.2
+diff --git a/tests/test_circular_imports.py b/tests/test_circular_imports.py
+index 22e5ea47..a655fd1d 100644
+--- a/tests/test_circular_imports.py
++++ b/tests/test_circular_imports.py
+@@ -113,6 +113,10 @@ def test_no_warnings(import_path: str) -> None:
+         "-W",
+         "ignore:Creating a LegacyVersion has been deprecated and will "
+         "be removed in the next major release:DeprecationWarning:",
++        # Deprecation warning emitted by setuptools v67.5.0+ triggered by importing
++        # `gunicorn.util`.
++        "-W", "ignore:pkg_resources is deprecated as an API:"
++        "DeprecationWarning",
+         "-c", f"import {import_path!s}",
+         # fmt: on
+     )
diff --git a/pkgs/development/python-modules/aiojobs/default.nix b/pkgs/development/python-modules/aiojobs/default.nix
index 320593f79370d..a3b982e22d5a9 100644
--- a/pkgs/development/python-modules/aiojobs/default.nix
+++ b/pkgs/development/python-modules/aiojobs/default.nix
@@ -37,6 +37,8 @@ buildPythonPackage rec {
     async-timeout
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
     pytest-aiohttp
diff --git a/pkgs/development/python-modules/amqp/default.nix b/pkgs/development/python-modules/amqp/default.nix
index bd834b9e14915..bad99ab8f02ac 100644
--- a/pkgs/development/python-modules/amqp/default.nix
+++ b/pkgs/development/python-modules/amqp/default.nix
@@ -3,6 +3,7 @@
 , case
 , fetchPypi
 , pytestCheckHook
+, pytest-rerunfailures
 , pythonOlder
 , vine
 }:
@@ -23,9 +24,12 @@ buildPythonPackage rec {
     vine
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     case
     pytestCheckHook
+    pytest-rerunfailures
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/ansi2html/default.nix b/pkgs/development/python-modules/ansi2html/default.nix
index 97553b1b31e1e..192ecaf2eab4c 100644
--- a/pkgs/development/python-modules/ansi2html/default.nix
+++ b/pkgs/development/python-modules/ansi2html/default.nix
@@ -1,22 +1,42 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k, six, mock, pytestCheckHook, setuptools, setuptools-scm }:
+{ lib
+, buildPythonPackage
+, fetchpatch
+, fetchPypi
+, pytestCheckHook
+, setuptools
+, setuptools-scm
+, wheel
+}:
 
 buildPythonPackage rec {
   pname = "ansi2html";
   version = "1.8.0";
   format = "pyproject";
 
-  disabled = !isPy3k;
-
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-OLgqKYSCofomE/D5yb6z23Ko+DLurFjrLke/Ms039tU=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
-  propagatedBuildInputs = [ six setuptools ];
+  patches = [
+    (fetchpatch {
+      name = "update-build-requirements.patch";
+      url = "https://github.com/pycontribs/ansi2html/commit/be9c47dd39e500b2e34e95efde90d0a3b44daaee.patch";
+      hash = "sha256-nvOclsgysg+4sK694ppls0BLfq5MCJJQW3V/Ru30D/k=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
 
   preCheck = "export PATH=$PATH:$out/bin";
-  nativeCheckInputs = [ mock pytestCheckHook ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "ansi2html" ];
 
diff --git a/pkgs/development/python-modules/asyncssh/default.nix b/pkgs/development/python-modules/asyncssh/default.nix
index 3f52c3acd354d..bdc436c8fdc47 100644
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@@ -58,6 +58,8 @@ buildPythonPackage rec {
     ];
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     openssh
     openssl
diff --git a/pkgs/development/python-modules/bluetooth-data-tools/default.nix b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
index 918cba4f54b1a..a68f8c8da4304 100644
--- a/pkgs/development/python-modules/bluetooth-data-tools/default.nix
+++ b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, cython_3
 , poetry-core
 , pytestCheckHook
 , pythonOlder
@@ -9,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-data-tools";
-  version = "1.6.1";
+  version = "1.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -18,10 +19,15 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-A3zdM2kVmz8cUix9JT8cnIABZK64r6yiZisvb8A1RSQ=";
+    hash = "sha256-EmZPiZKm/80nJpPnJWhI9i4I6MhgQMifLOEUBFLqbSw=";
   };
 
+  # The project can build both an optimized cython version and an unoptimized
+  # python version. This ensures we fail if we build the wrong one.
+  env.REQUIRE_CYTHON = 1;
+
   nativeBuildInputs = [
+    cython_3
     poetry-core
     setuptools
   ];
@@ -43,7 +49,7 @@ buildPythonPackage rec {
     description = "Library for converting bluetooth data and packets";
     homepage = "https://github.com/Bluetooth-Devices/bluetooth-data-tools";
     changelog = "https://github.com/Bluetooth-Devices/bluetooth-data-tools/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ asl20 ];
+    license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/coffea/default.nix b/pkgs/development/python-modules/coffea/default.nix
index ac0c293e29ab2..ba60cc47a8c39 100644
--- a/pkgs/development/python-modules/coffea/default.nix
+++ b/pkgs/development/python-modules/coffea/default.nix
@@ -43,7 +43,8 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "numba>=0.57.0" "numba"
+      --replace "numba>=0.57.0" "numba" \
+      --replace "numpy>=1.22.0,<1.25" "numpy"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/curio/default.nix b/pkgs/development/python-modules/curio/default.nix
index e067e134d04cd..501cdd442ab92 100644
--- a/pkgs/development/python-modules/curio/default.nix
+++ b/pkgs/development/python-modules/curio/default.nix
@@ -26,13 +26,16 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   disabledTests = [
-     "test_aside_basic" # times out
-     "test_write_timeout" # flaky, does not always time out
-     "test_aside_cancel" # fails because modifies PYTHONPATH and cant find pytest
-     "test_ssl_outgoing" # touches network
-     "test_unix_echo" # socket bind error on hydra when built with other packages
-     "test_unix_ssl_server" # socket bind error on hydra when built with other packages
-   ];
+    "test_aside_basic" # times out
+    "test_write_timeout" # flaky, does not always time out
+    "test_aside_cancel" # fails because modifies PYTHONPATH and cant find pytest
+    "test_ssl_outgoing" # touches network
+    "test_unix_echo" # socket bind error on hydra when built with other packages
+    "test_unix_ssl_server" # socket bind error on hydra when built with other packages
+  ] ++ lib.optionals stdenv.isDarwin [
+    # connects to python.org:1, expects an OsError, hangs in the darwin sandbox
+    "test_create_bad_connection"
+  ];
 
   pythonImportsCheck = [ "curio" ];
 
diff --git a/pkgs/development/python-modules/datadog/default.nix b/pkgs/development/python-modules/datadog/default.nix
index d382794523176..fb3271af586fa 100644
--- a/pkgs/development/python-modules/datadog/default.nix
+++ b/pkgs/development/python-modules/datadog/default.nix
@@ -34,6 +34,8 @@ buildPythonPackage rec {
     requests
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     click
     freezegun
diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index 5a8f268828c46..7b7c5f59ad95f 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -1,12 +1,14 @@
 { lib
 , async-timeout
 , buildPythonPackage
+, cython_3
 , fetchFromGitHub
 , poetry-core
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -23,9 +25,15 @@ buildPythonPackage rec {
     hash = "sha256-JlR2eoNOsZ/YE313fWAtoxJhlpMnUaDJcFpwA2b6p4c=";
   };
 
+  # The project can build both an optimized cython version and an unoptimized
+  # python version. This ensures we fail if we build the wrong one.
+  env.REQUIRE_CYTHON = 1;
+
   nativeBuildInputs = [
+    cython_3
     poetry-core
     setuptools
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/devolo-plc-api/default.nix b/pkgs/development/python-modules/devolo-plc-api/default.nix
index d352925308cbe..c6d5b7df26607 100644
--- a/pkgs/development/python-modules/devolo-plc-api/default.nix
+++ b/pkgs/development/python-modules/devolo-plc-api/default.nix
@@ -44,6 +44,8 @@ buildPythonPackage rec {
     zeroconf
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-asyncio
     pytest-httpx
diff --git a/pkgs/development/python-modules/django-cachalot/default.nix b/pkgs/development/python-modules/django-cachalot/default.nix
index f52a3aa46e62a..33d9e484f1146 100644
--- a/pkgs/development/python-modules/django-cachalot/default.nix
+++ b/pkgs/development/python-modules/django-cachalot/default.nix
@@ -6,18 +6,19 @@
 , psycopg2
 , beautifulsoup4
 , python
+, pytz
 }:
 
 buildPythonPackage rec {
   pname = "django-cachalot";
-  version = "2.5.3";
+  version = "2.6.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "noripyt";
     repo = "django-cachalot";
     rev = "v${version}";
-    hash = "sha256-ayAN+PgK3aIpt4R8aeC6c6mRGTnfObycmkoXPTjx4WI=";
+    hash = "sha256-bCiIZkh02+7xL6aSWE9by+4dFDsanr0iXuO9QKpLOjw=";
   };
 
   patches = [
@@ -34,6 +35,7 @@ buildPythonPackage rec {
     beautifulsoup4
     django-debug-toolbar
     psycopg2
+    pytz
   ];
 
   pythonImportsCheck = [ "cachalot" ];
diff --git a/pkgs/development/python-modules/django-cacheops/default.nix b/pkgs/development/python-modules/django-cacheops/default.nix
index 566eb06f50436..4c6c4e786ade6 100644
--- a/pkgs/development/python-modules/django-cacheops/default.nix
+++ b/pkgs/development/python-modules/django-cacheops/default.nix
@@ -42,6 +42,8 @@ buildPythonPackage rec {
     six
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
     pytest-django
diff --git a/pkgs/development/python-modules/django-compat/default.nix b/pkgs/development/python-modules/django-compat/default.nix
deleted file mode 100644
index d33a4be2817f1..0000000000000
--- a/pkgs/development/python-modules/django-compat/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib, buildPythonPackage, fetchFromGitHub, python,
-  django, six
-}:
-
-buildPythonPackage rec {
-  pname = "django-compat";
-  version = "1.0.15";
-
-  # the pypi packages don't include everything required for the tests
-  src = fetchFromGitHub {
-    owner = "arteria";
-    repo = "django-compat";
-    rev = "v${version}";
-    sha256 = "1pr6v38ahrsvxlgmcx69s4b5q5082f44gzi4h3c32sccdc4pwqxp";
-  };
-
-  patches = [
-    ./fix-tests.diff
-  ];
-
-  checkPhase = ''
-    runHook preCheck
-
-    # to convince the tests to run against the installed package, not the source directory, we extract the
-    # tests directory from it then dispose of the actual source
-    mv compat/tests .
-    rm -r compat
-    substituteInPlace runtests.py --replace compat.tests tests
-    ${python.interpreter} runtests.py
-
-    runHook postCheck
-  '';
-
-  propagatedBuildInputs = [ django six ];
-
-  meta = with lib; {
-    description = "Forward and backwards compatibility layer for Django 1.4, 1.7, 1.8, 1.9, 1.10 and 1.11";
-    homepage = "https://github.com/arteria/django-compat";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ris ];
-  };
-}
diff --git a/pkgs/development/python-modules/django-compat/fix-tests.diff b/pkgs/development/python-modules/django-compat/fix-tests.diff
deleted file mode 100644
index 58165db96a87b..0000000000000
--- a/pkgs/development/python-modules/django-compat/fix-tests.diff
+++ /dev/null
@@ -1,56 +0,0 @@
-diff -ur a/compat/tests/settings.py b/compat/tests/settings.py
---- a/compat/tests/settings.py	2020-03-06 15:32:07.548482597 +0100
-+++ b/compat/tests/settings.py	2020-03-06 22:19:25.422934249 +0100
-@@ -16,11 +16,12 @@
-     'django.contrib.admin',
-     'django.contrib.auth',
-     'django.contrib.contenttypes',
-+    'django.contrib.messages',
-     'compat',
-     'compat.tests.test_app',
- ]
- 
--MIDDLEWARE_CLASSES = (
-+MIDDLEWARE = (
-     'django.contrib.sessions.middleware.SessionMiddleware',
-     'django.middleware.common.CommonMiddleware',
-     'django.middleware.csrf.CsrfViewMiddleware',
-@@ -43,6 +44,7 @@
-                 'django.template.context_processors.i18n',
-                 'django.template.context_processors.tz',
-                 'django.template.context_processors.request',
-+                'django.contrib.messages.context_processors.messages',
-             ],
-             'loaders': [
-                 'django.template.loaders.filesystem.Loader',
-diff -ur a/compat/tests/test_compat.py b/compat/tests/test_compat.py
---- a/compat/tests/test_compat.py	2020-03-06 15:32:07.548482597 +0100
-+++ b/compat/tests/test_compat.py	2020-03-06 15:37:39.202835075 +0100
-@@ -9,7 +9,7 @@
- from django.core.serializers.json import DjangoJSONEncoder
- from django.test import TestCase, SimpleTestCase
- from django.test.client import RequestFactory
--from django.contrib.auth.views import logout
-+from django.contrib.auth.views import auth_logout
- try:
-     from django.urls import NoReverseMatch
- except ImportError:
-@@ -103,7 +103,7 @@
-         Tests that passing a view name to ``resolve_url`` will result in the
-         URL path mapping to that view name.
-         """
--        resolved_url = resolve_url(logout)
-+        resolved_url = resolve_url(auth_logout)
-         self.assertEqual('/accounts/logout/', resolved_url)
- 
-     '''
-diff -ur a/compat/tests/urls.py b/compat/tests/urls.py
---- a/compat/tests/urls.py	2020-03-06 15:32:07.548482597 +0100
-+++ b/compat/tests/urls.py	2020-03-06 15:34:25.962377799 +0100
-@@ -2,5 +2,5 @@
- from django.contrib.auth import views
- 
- urlpatterns = [
--    url(r'^accounts/logout/$', views.logout, name='logout'),
-+    url(r'^accounts/logout/$', views.auth_logout, name='logout'),
- ]
diff --git a/pkgs/development/python-modules/django-haystack/default.nix b/pkgs/development/python-modules/django-haystack/default.nix
index e85d27f907bd3..d9d6fb8ecd6fc 100644
--- a/pkgs/development/python-modules/django-haystack/default.nix
+++ b/pkgs/development/python-modules/django-haystack/default.nix
@@ -4,12 +4,14 @@
 , fetchPypi
 
 # build dependencies
+, setuptools
 , setuptools-scm
 
 # dependencies
 , django
 
 # tests
+, elasticsearch
 , geopy
 , nose
 , pysolr
@@ -21,7 +23,8 @@
 buildPythonPackage rec {
   pname = "django-haystack";
   version = "3.2.1";
-  format = "setuptools";
+  format = "pyproject";
+
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
@@ -35,13 +38,22 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  buildInputs = [
     django
   ];
 
+  passthru.optional-dependencies = {
+    elasticsearch = [
+      elasticsearch
+    ];
+  };
+
+  doCheck = lib.versionOlder django.version "4";
+
   nativeCheckInputs = [
     geopy
     nose
@@ -49,7 +61,14 @@ buildPythonPackage rec {
     python-dateutil
     requests
     whoosh
-  ];
+  ]
+  ++ passthru.optional-dependencies.elasticsearch;
+
+  checkPhase = ''
+    runHook preCheck
+    python test_haystack/run_tests.py
+    runHook postCheck
+  '';
 
   meta = with lib; {
     description = "Pluggable search for Django";
diff --git a/pkgs/development/python-modules/django-hijack/default.nix b/pkgs/development/python-modules/django-hijack/default.nix
index 18ef2e3ace79b..ef77abefeeae0 100644
--- a/pkgs/development/python-modules/django-hijack/default.nix
+++ b/pkgs/development/python-modules/django-hijack/default.nix
@@ -11,7 +11,6 @@
 
 # dependencies
 , django
-, django-compat
 
 # tests
 , pytest-django
@@ -54,7 +53,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     django
-    django-compat
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/django-mailman3/default.nix b/pkgs/development/python-modules/django-mailman3/default.nix
index 32bfe947c82f8..6639257740bc9 100644
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@@ -1,27 +1,50 @@
-{ lib, buildPythonPackage, fetchPypi, django-gravatar2, django-compressor
-, django-allauth, mailmanclient, django, mock
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# propagates
+, django-gravatar2
+, django-allauth
+, mailmanclient
+, pytz
+
+# tests
+, django
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-mailman3";
   version = "1.3.9";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-GpI1W0O9aJpLF/mcS23ktJDZsP69S2zQy7drOiWBnTM=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'django>=3.2,<4.2' 'django>=3.2,<4.3'
+  '';
+
   propagatedBuildInputs = [
-    django-gravatar2 django-compressor django-allauth mailmanclient
+    django-allauth
+    django-gravatar2
+    mailmanclient
+    pytz
   ];
-  nativeCheckInputs = [ django mock ];
 
-  checkPhase = ''
-    cd $NIX_BUILD_TOP/$sourceRoot
-    PYTHONPATH=.:$PYTHONPATH django-admin.py test --settings=django_mailman3.tests.settings_test
-  '';
+  nativeCheckInputs = [
+    django
+    pytest-django
+    pytestCheckHook
+  ];
 
-  pythonImportsCheck = [ "django_mailman3" ];
+  pythonImportsCheck = [
+    "django_mailman3"
+  ];
 
   meta = with lib; {
     description = "Django library for Mailman UIs";
diff --git a/pkgs/development/python-modules/django-modelcluster/default.nix b/pkgs/development/python-modules/django-modelcluster/default.nix
index b7fbc9f2b1796..5ad43dfc9b1f8 100644
--- a/pkgs/development/python-modules/django-modelcluster/default.nix
+++ b/pkgs/development/python-modules/django-modelcluster/default.nix
@@ -1,11 +1,18 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+
+# dependencies
 , django
-, django-taggit
 , pytz
-, pythonOlder
-, python
+
+# optionals
+, django-taggit
+
+# tests
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -17,8 +24,8 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "wagtail";
-    repo = pname;
-    rev = "v${version}";
+    repo = "modelcluster";
+    rev = "refs/tags/v${version}";
     hash = "sha256-p6hvOkPWRVJYLHvwyn9nS05wblikRFmlSYZuLiCcuqc=";
   };
 
@@ -31,13 +38,17 @@ buildPythonPackage rec {
     django-taggit
   ];
 
-  nativeCheckInputs = passthru.optional-dependencies.taggit;
+  env.DJANGO_SETTINGS_MODULE = "tests.settings";
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} ./runtests.py --noinput
-    runHook postCheck
-  '';
+  nativeCheckInputs = [
+    pytest-django
+    pytestCheckHook
+  ] ++ passthru.optional-dependencies.taggit;
+
+  # https://github.com/wagtail/django-modelcluster/issues/173
+  disabledTests = lib.optionals (lib.versionAtLeast django.version "4.2") [
+    "test_formfield_callback"
+  ];
 
   meta = with lib; {
     description = "Django extension to allow working with 'clusters' of models as a single unit, independently of the database";
diff --git a/pkgs/development/python-modules/django-pattern-library/default.nix b/pkgs/development/python-modules/django-pattern-library/default.nix
index 40cc4f64188ab..00b6fe9c978f6 100644
--- a/pkgs/development/python-modules/django-pattern-library/default.nix
+++ b/pkgs/development/python-modules/django-pattern-library/default.nix
@@ -51,5 +51,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/torchbox/django-pattern-library/blob/v${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ sephi ];
+    # https://github.com/torchbox/django-pattern-library/issues/212
+    broken = lib.versionAtLeast django.version "4.2";
   };
 }
diff --git a/pkgs/development/python-modules/django-scim2/default.nix b/pkgs/development/python-modules/django-scim2/default.nix
index 90db4fe633d38..536d851a4099f 100644
--- a/pkgs/development/python-modules/django-scim2/default.nix
+++ b/pkgs/development/python-modules/django-scim2/default.nix
@@ -2,37 +2,43 @@
 , buildPythonPackage
 , fetchFromGitHub
 
+# build-system
+, poetry-core
+
 # propagates
 , django
-, python-dateutil
 , scim2-filter-parser
-, gssapi
-, python-ldap
-, sssd
 
 # tests
 , mock
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-scim2";
-  version = "0.17.3";
-  format = "setuptools";
+  version = "0.19.0";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "15five";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-5zdGPpjooiFoj+2OoglXhhKsPFB/KOHvrZWZd+1nZqU=";
+    hash = "sha256-larDh4f9/xVr11/n/WfkJ2Tx45DMQqyK3ZzkWAvzeig=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "poetry.masonry.api" "poetry.core.masonry.api"
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
     django
-    python-dateutil
     scim2-filter-parser
-    gssapi
-    python-ldap
-    sssd
   ];
 
   pythonImportsCheck = [
@@ -41,9 +47,12 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     mock
+    pytest-django
+    pytestCheckHook
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/15five/django-scim2/blob/${src.rev}/CHANGES.txt";
     description = "A SCIM 2.0 Service Provider Implementation (for Django)";
     homepage = "https://github.com/15five/django-scim2";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/django-sites/default.nix b/pkgs/development/python-modules/django-sites/default.nix
index 5587014c57403..3a9255daecdf2 100644
--- a/pkgs/development/python-modules/django-sites/default.nix
+++ b/pkgs/development/python-modules/django-sites/default.nix
@@ -37,5 +37,7 @@ buildPythonPackage rec {
     description = "Alternative implementation of django sites framework";
     homepage = "https://github.com/niwinz/django-sites";
     license = lib.licenses.bsd3;
+    # has not been updated for django>=4.0
+    broken = lib.versionAtLeast django.version "4";
   };
 }
diff --git a/pkgs/development/python-modules/djangorestframework-guardian/default.nix b/pkgs/development/python-modules/djangorestframework-guardian/default.nix
index fdc6b3184d981..4358a61b3452a 100644
--- a/pkgs/development/python-modules/djangorestframework-guardian/default.nix
+++ b/pkgs/development/python-modules/djangorestframework-guardian/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, django
 , django-guardian
 , djangorestframework
 }:
@@ -37,5 +38,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/rpkilby/django-rest-framework-guardian";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
+    # unmaintained, last compatible version is 3.x, use djangorestframework-guardian2 instead
+    broken = lib.versionAtLeast django.version "4";
   };
 }
diff --git a/pkgs/development/python-modules/drf-nested-routers/default.nix b/pkgs/development/python-modules/drf-nested-routers/default.nix
index 15676ed304b62..849fe8bb130c4 100644
--- a/pkgs/development/python-modules/drf-nested-routers/default.nix
+++ b/pkgs/development/python-modules/drf-nested-routers/default.nix
@@ -1,33 +1,55 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, setuptools
+, fetchpatch
 , django
 , djangorestframework
-, pytest
-, pytest-cov
+, pytestCheckHook
 , pytest-django
 , ipdb
-, python
 }:
 
 buildPythonPackage rec {
   pname = "drf-nested-routers";
   version = "0.93.4";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "alanjds";
     repo = "drf-nested-routers";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-qlXNDydoQJ9FZB6G7yV/pNmx3BEo+lvRqsfjrvlbdNY=";
   };
 
-  propagatedBuildInputs = [ django djangorestframework setuptools ];
-  nativeCheckInputs = [ pytest pytest-cov pytest-django ipdb ];
+  patches = [
+    # django4 compatibility
+    (fetchpatch {
+      url = "https://github.com/alanjds/drf-nested-routers/commit/59764cc356f7f593422b26845a9dfac0ad196120.patch";
+      hash = "sha256-mq3vLHzQlGl2EReJ5mVVQMMcYgGIVt/T+qi1STtQ0aI=";
+    })
+    (fetchpatch {
+      url = "https://github.com/alanjds/drf-nested-routers/commit/723a5729dd2ffcb66fe315f229789ca454986fa4.patch";
+      hash = "sha256-UCbBjwlidqsJ9vEEWlGzfqqMOr0xuB2TAaUxHsLzFfU=";
+    })
+    (fetchpatch {
+      url = "https://github.com/alanjds/drf-nested-routers/commit/38e49eb73759bc7dcaaa9166169590f5315e1278.patch";
+      hash = "sha256-IW4BLhHHhXDUZqHaXg46qWoQ89pMXv0ZxKjOCTnDcI0=";
+    })
+  ];
 
-  checkPhase = ''
-    ${python.interpreter} runtests.py --nolint
-  '';
+  buildInputs = [
+    django
+  ];
+
+  propagatedBuildInputs = [
+    djangorestframework
+  ];
+
+  nativeCheckInputs = [
+    ipdb
+    pytestCheckHook
+    pytest-django
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/alanjds/drf-nested-routers";
diff --git a/pkgs/development/python-modules/falcon/default.nix b/pkgs/development/python-modules/falcon/default.nix
index 341d3c6615068..b0880c384dba1 100644
--- a/pkgs/development/python-modules/falcon/default.nix
+++ b/pkgs/development/python-modules/falcon/default.nix
@@ -45,6 +45,8 @@ buildPythonPackage rec {
     cython
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   preCheck = ''
     export HOME=$TMPDIR
     cp -R tests examples $TMPDIR
diff --git a/pkgs/development/python-modules/feedparser/default.nix b/pkgs/development/python-modules/feedparser/default.nix
index 02396ec834313..7eaf65b371dff 100644
--- a/pkgs/development/python-modules/feedparser/default.nix
+++ b/pkgs/development/python-modules/feedparser/default.nix
@@ -22,6 +22,8 @@ buildPythonPackage rec {
     sgmllib3k
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   checkPhase = ''
     # Tests are failing
     # AssertionError: unexpected '~' char in declaration
diff --git a/pkgs/development/python-modules/ffmpy/default.nix b/pkgs/development/python-modules/ffmpy/default.nix
new file mode 100644
index 0000000000000..c3b0c6078f42f
--- /dev/null
+++ b/pkgs/development/python-modules/ffmpy/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, go
+, ffmpeg-headless
+}:
+
+buildPythonPackage rec {
+  pname = "ffmpy";
+  version = "0.3.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "Ch00k";
+    repo = "ffmpy";
+    rev = "refs/tags/${version}";
+    hash = "sha256-kuLhmCG80BmXdqpW67UanBnuYiL2Oh1jKt7IgmVNEAM=";
+  };
+
+  postPatch = ''
+    # default to store ffmpeg
+    substituteInPlace ffmpy.py \
+      --replace 'executable="ffmpeg",' 'executable="${ffmpeg-headless}/bin/ffmpeg",'
+
+    #  The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail.
+    for fname in tests/*.py; do
+      echo 'FFmpeg.__init__.__defaults__ = ("ffmpeg", *FFmpeg.__init__.__defaults__[1:])' >>"$fname"
+    done
+  '';
+
+  pythonImportsCheck = [ "ffmpy" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    go
+  ];
+
+  # the vendored ffmpeg mock binary assumes FHS
+  preCheck = ''
+    rm -v tests/ffmpeg/ffmpeg
+    HOME=$(mktemp -d) go build -o ffmpeg tests/ffmpeg/ffmpeg.go
+    export PATH=".:$PATH"
+  '';
+
+  meta = with lib; {
+    description = "A simple python interface for FFmpeg/FFprobe";
+    homepage = "https://github.com/Ch00k/ffmpy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/development/python-modules/flit-core/default.nix b/pkgs/development/python-modules/flit-core/default.nix
index 0d0c3785f8818..fc4d6479caee0 100644
--- a/pkgs/development/python-modules/flit-core/default.nix
+++ b/pkgs/development/python-modules/flit-core/default.nix
@@ -1,6 +1,5 @@
 { lib
 , buildPythonPackage
-, callPackage
 , flit
 }:
 
@@ -9,28 +8,15 @@ buildPythonPackage rec {
   inherit (flit) version;
   format = "pyproject";
 
-  outputs = [
-    "out"
-    "testsout"
-  ];
-
   inherit (flit) src patches;
 
-  preConfigure = ''
-    cd flit_core
-  '';
-
-  postInstall = ''
-    mkdir $testsout
-    cp -R ../tests $testsout/tests
-  '';
+  sourceRoot = "source/flit_core";
 
-  # check in passthru.tests.pytest to escape infinite recursion with setuptools-scm
+  # Tests are run in the "flit" package.
   doCheck = false;
 
   passthru.tests = {
     inherit flit;
-    pytest = callPackage ./tests.nix { };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/flit-core/tests.nix b/pkgs/development/python-modules/flit-core/tests.nix
deleted file mode 100644
index 49d6ac89fce66..0000000000000
--- a/pkgs/development/python-modules/flit-core/tests.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ buildPythonPackage
-, flit
-, flit-core
-, pytestCheckHook
-, testpath
-}:
-
-buildPythonPackage {
-  pname = "flit-core";
-  inherit (flit-core) version;
-
-  src = flit-core.testsout;
-
-  dontBuild = true;
-  dontInstall = true;
-
-  nativeCheckInputs = [
-    flit
-    pytestCheckHook
-    testpath
-  ];
-}
diff --git a/pkgs/development/python-modules/google-auth-httplib2/default.nix b/pkgs/development/python-modules/google-auth-httplib2/default.nix
index e185a88858d58..c35297f6b5cf4 100644
--- a/pkgs/development/python-modules/google-auth-httplib2/default.nix
+++ b/pkgs/development/python-modules/google-auth-httplib2/default.nix
@@ -27,6 +27,8 @@ buildPythonPackage rec {
     httplib2
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flask
     mock
diff --git a/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py b/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
new file mode 100644
index 0000000000000..4738de3175526
--- /dev/null
+++ b/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
@@ -0,0 +1,57 @@
+# This is a pytest hook that skips tests that tries to access the network.
+# These tests will immediately fail, then get marked as "Expected fail" (xfail).
+
+from _pytest.runner import pytest_runtest_makereport as orig_pytest_runtest_makereport
+
+# We use BaseException to minimize the chance it gets caught and 'pass'ed
+class NixNetworkAccessDeniedError(BaseException):
+    pass
+
+def pytest_runtest_makereport(item, call):
+    """
+    Modifies test results after-the-fact. The function name is magic, see:
+    https://docs.pytest.org/en/7.1.x/reference/reference.html?highlight=pytest_runtest_makereport#std-hook-pytest_runtest_makereport
+    """
+
+    def iterate_exc_chain(exc: Exception):
+        """
+        Recurses through exception chain, yielding all exceptions
+        """
+        yield exc
+        if getattr(exc, "__context__", None) is not None:
+            yield from iterate_exc_chain(exc.__context__)
+        if getattr(exc, "__cause__", None) is not None:
+            yield from iterate_exc_chain(exc.__cause__)
+
+    tr = orig_pytest_runtest_makereport(item, call)
+    if call.excinfo is not None:
+        for exc in iterate_exc_chain(call.excinfo.value):
+            if isinstance(exc, NixNetworkAccessDeniedError):
+                tr.outcome, tr.wasxfail = 'skipped', "reason: Requires network access."
+            if isinstance(exc, FileNotFoundError):  # gradio specific
+                tr.outcome, tr.wasxfail = 'skipped', "reason: Pypi dist bad."
+    return tr
+
+# replace network access with exception
+
+def deny_network_access(*a, **kw):
+    raise NixNetworkAccessDeniedError
+
+import httpx
+import requests
+import socket
+import urllib
+import urllib3
+import websockets
+
+httpx.AsyncClient.get = deny_network_access
+httpx.AsyncClient.head = deny_network_access
+httpx.Request = deny_network_access
+requests.get = deny_network_access
+requests.head = deny_network_access
+requests.post = deny_network_access
+socket.socket.connect = deny_network_access
+urllib.request.Request = deny_network_access
+urllib.request.urlopen = deny_network_access
+urllib3.connection.HTTPSConnection._new_conn = deny_network_access
+websockets.connect = deny_network_access
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
new file mode 100644
index 0000000000000..ffb99d7293287
--- /dev/null
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -0,0 +1,175 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, pythonRelaxDepsHook
+, writeText
+
+# pyproject
+, hatchling
+, hatch-requirements-txt
+, hatch-fancy-pypi-readme
+
+# runtime
+, setuptools
+, aiofiles
+, aiohttp
+, altair
+, fastapi
+, ffmpy
+, markdown-it-py
+, mdit-py-plugins
+, markupsafe
+, matplotlib
+, numpy
+, orjson
+, pandas
+, pillow
+, pycryptodome
+, python-multipart
+, pydub
+, pyyaml
+, requests
+, uvicorn
+, jinja2
+, fsspec
+, httpx
+, pydantic
+, websockets
+, typing-extensions
+
+# check
+, pytestCheckHook
+, pytest-asyncio
+, mlflow
+, huggingface-hub
+, transformers
+, wandb
+, respx
+, scikit-image
+, ipython
+, ffmpeg
+, vega_datasets
+, boto3
+}:
+
+buildPythonPackage rec {
+  pname = "gradio";
+  version = "3.20.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  # We use the Pypi release, as it provides prebuilt webui assets,
+  # and has more frequent releases compared to github tags
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-oG97GwehyBWjWXzDqyfj+x2mAfM6OQhYKdA3j0Rv8Vs=";
+  };
+
+  pythonRelaxDeps = [
+    "mdit-py-plugins"
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    hatchling
+    hatch-requirements-txt
+    hatch-fancy-pypi-readme
+  ];
+
+  propagatedBuildInputs = [
+    setuptools # needs pkg_resources
+    aiofiles
+    aiohttp
+    altair
+    fastapi
+    ffmpy
+    markdown-it-py
+    mdit-py-plugins
+    markupsafe
+    matplotlib
+    numpy
+    orjson
+    pandas
+    pillow
+    pycryptodome
+    python-multipart
+    pydub
+    pyyaml
+    requests
+    uvicorn
+    jinja2
+    fsspec
+    httpx
+    pydantic
+    websockets
+    typing-extensions
+  ] ++ markdown-it-py.optional-dependencies.linkify;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    mlflow
+    #comet-ml # FIXME: enable once packaged
+    huggingface-hub
+    transformers
+    wandb
+    respx
+    scikit-image
+    ipython
+    ffmpeg
+    vega_datasets
+    boto3
+    # shap is needed as well, but breaks too often
+  ];
+
+  # Add a pytest hook skipping tests that access network, marking them as "Expected fail" (xfail).
+  # We additionally xfail FileNotFoundError, since the gradio devs often fail to upload test assets to pypi.
+  preCheck = let
+  in ''
+    export HOME=$TMPDIR
+    cat ${./conftest-skip-network-errors.py} >> test/conftest.py
+  '';
+
+  disabledTests = [
+    # Actually broken
+    "test_mount_gradio_app"
+
+    # FIXME: enable once comet-ml is packaged
+    "test_inline_display"
+    "test_integration_comet"
+
+    # Flaky, tries to pin dependency behaviour. Sensitive to dep versions
+    # These error only affect downstream use of the check dependencies.
+    "test_no_color"
+    "test_in_interface_as_output"
+    "test_should_warn_url_not_having_version"
+
+    # Flaky, unknown reason
+    "test_in_interface"
+
+    # shap is too often broken in nixpkgs
+    "test_shapley_text"
+  ];
+  disabledTestPaths = [
+    # makes pytest freeze 50% of the time
+    "test/test_interfaces.py"
+  ];
+  #pytestFlagsArray = [ "-x" "-W" "ignore" ]; # uncomment for debugging help
+
+  # check the binary works outside the build env
+  doInstallCheck = true;
+  postInstallCheck = ''
+    env --ignore-environment $out/bin/gradio --help >/dev/null
+  '';
+
+  pythonImportsCheck = [ "gradio" ];
+
+  meta = with lib; {
+    homepage = "https://www.gradio.app/";
+    description = "Python library for easily interacting with trained machine learning models";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/development/python-modules/graphene-django/default.nix b/pkgs/development/python-modules/graphene-django/default.nix
index 6379774590a4d..5ad186d75476f 100644
--- a/pkgs/development/python-modules/graphene-django/default.nix
+++ b/pkgs/development/python-modules/graphene-django/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , buildPythonPackage
 , pythonAtLeast
 , pythonOlder
@@ -61,11 +62,14 @@ buildPythonPackage rec {
   ];
 
   disabledTests = lib.optionals (pythonAtLeast "3.11") [
-    # Pèython 3.11 support, https://github.com/graphql-python/graphene-django/pull/1365
+    # Python 3.11 support, https://github.com/graphql-python/graphene-django/pull/1365
     "test_django_objecttype_convert_choices_enum_naming_collisions"
     "test_django_objecttype_choices_custom_enum_name"
     "test_django_objecttype_convert_choices_enum_list"
     "test_schema_representation"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # this test touches files in the "/" directory and fails in darwin sandbox
+    "test_should_filepath_convert_string"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 27a2fb54da8d7..991549ea9ed9f 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.54.2";
+  version = "1.57.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MlXL7Ft8cGyqPU3VhGBsCA5kFeFWMbsvYhXitwBVg20=";
+    hash = "sha256-sJjamd8e6+WDN/j3jlDfmQJzzKzBIm/d60fFkOPfngI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 6012a9eb135c5..78e3cdaae7f1d 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.54.2";
+  version = "1.57.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4RwsKu5T80CZLo5NalkXLLu9AZPxNR3pjE+BClBB1co=";
+    hash = "sha256-LxYTDYac4n7NYjGUVHtkndZXMz7H6GRMxXHGRXgam4U=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/gunicorn/default.nix b/pkgs/development/python-modules/gunicorn/default.nix
index c334a58ad567b..23bfaae0d2bdb 100644
--- a/pkgs/development/python-modules/gunicorn/default.nix
+++ b/pkgs/development/python-modules/gunicorn/default.nix
@@ -6,7 +6,6 @@
 , eventlet
 , gevent
 , pytestCheckHook
-, setuptools
 }:
 
 buildPythonPackage rec {
@@ -28,7 +27,6 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    setuptools
     packaging
   ];
 
diff --git a/pkgs/development/python-modules/httplib2/default.nix b/pkgs/development/python-modules/httplib2/default.nix
index 99dd53ddd0a90..c201bc3126c83 100644
--- a/pkgs/development/python-modules/httplib2/default.nix
+++ b/pkgs/development/python-modules/httplib2/default.nix
@@ -26,6 +26,10 @@ buildPythonPackage rec {
     hash = "sha256-1Pl+l28J7crfO2UY/9/D019IzOHWOwjR+UvVEHICTqU=";
   };
 
+  postPatch = ''
+    sed -i "/--cov/d" setup.cfg
+  '';
+
   propagatedBuildInputs = [
     pyparsing
   ];
@@ -40,13 +44,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   # Don't run tests for older Pythons
   doCheck = pythonAtLeast "3.9";
 
-  postPatch = ''
-    sed -i "/--cov/d" setup.cfg
-  '';
-
   disabledTests = [
     # ValueError: Unable to load PEM file.
     # https://github.com/httplib2/httplib2/issues/192#issuecomment-993165140
diff --git a/pkgs/development/python-modules/httpx-socks/default.nix b/pkgs/development/python-modules/httpx-socks/default.nix
index 996db8ec1b301..992ddf1c69327 100644
--- a/pkgs/development/python-modules/httpx-socks/default.nix
+++ b/pkgs/development/python-modules/httpx-socks/default.nix
@@ -54,6 +54,8 @@ buildPythonPackage rec {
     ];
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flask
     hypercorn
diff --git a/pkgs/development/python-modules/josepy/default.nix b/pkgs/development/python-modules/josepy/default.nix
index 76004df63bc8f..f8a76641f537b 100644
--- a/pkgs/development/python-modules/josepy/default.nix
+++ b/pkgs/development/python-modules/josepy/default.nix
@@ -1,11 +1,11 @@
 { lib
 , buildPythonPackage
 , cryptography
+, fetchpatch
 , fetchPypi
 , pyopenssl
 , pytestCheckHook
 , pythonOlder
-, setuptools
 }:
 
 buildPythonPackage rec {
@@ -20,10 +20,19 @@ buildPythonPackage rec {
     hash = "sha256-iTHa84+KTIUnSg6LfLJa3f2NHyj5+4++0FPdUa7HXck=";
   };
 
+  patches = [
+    # https://github.com/certbot/josepy/pull/158
+    (fetchpatch {
+      name = "fix-setuptools-deprecation.patch";
+      url = "https://github.com/certbot/josepy/commit/8f1b4b57a29a868a87fd6eee19a67a7ebfc07ea1.patch";
+      hash = "sha256-9d+Bk/G4CJXpnjJU0YkXLsg0G3tPxR8YN2niqriQQkI=";
+      includes = [ "tests/test_util.py" ];
+    })
+  ];
+
   propagatedBuildInputs = [
     pyopenssl
     cryptography
-    setuptools
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/markdown-it-py/default.nix b/pkgs/development/python-modules/markdown-it-py/default.nix
index 38d92159f3b2e..3330817fb8a46 100644
--- a/pkgs/development/python-modules/markdown-it-py/default.nix
+++ b/pkgs/development/python-modules/markdown-it-py/default.nix
@@ -19,6 +19,7 @@
 , stdenv
 , pytest-regressions
 , pytestCheckHook
+, pythonRelaxDepsHook
 , pythonOlder
 }:
 
@@ -36,7 +37,13 @@ buildPythonPackage rec {
     hash = "sha256-qdRU1BxczFDGoIEtl0ZMkKNn4p5tec8YuPt5ZwX5fYM=";
   };
 
+  # fix downstrem usage of markdown-it-py[linkify]
+  pythonRelaxDeps = [
+    "linkify-it-py"
+  ];
+
   nativeBuildInputs = [
+    pythonRelaxDepsHook
     flit-core
   ];
 
diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 866512a4cfdd6..4b45ee4e77d34 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -43,13 +43,6 @@ buildPythonPackage rec {
     ./add-build-flags.sh
   ];
 
-  # Ugly work-around. Drop ninja dependency.
-  # We already have ninja, but it comes without METADATA.
-  # Building ninja-python-distributions is the way to go.
-  postPatch = ''
-    substituteInPlace pyproject.toml --replace "'ninja'," ""
-  '';
-
   meta = {
     changelog = "https://github.com/mesonbuild/meson-python/blob/${version}/CHANGELOG.rst";
     description = "Meson Python build backend (PEP 517)";
diff --git a/pkgs/development/python-modules/mezzanine/default.nix b/pkgs/development/python-modules/mezzanine/default.nix
index 9eda32b4e48a4..46bf44bf8ad90 100644
--- a/pkgs/development/python-modules/mezzanine/default.nix
+++ b/pkgs/development/python-modules/mezzanine/default.nix
@@ -14,6 +14,7 @@
 , pillow
 , pyflakes
 , pythonOlder
+, pytz
 , requests
 , requests-oauthlib
 , tzlocal
@@ -47,6 +48,7 @@ buildPythonPackage rec {
     future
     grappelli_safe
     pillow
+    pytz
     requests
     requests-oauthlib
     tzlocal
diff --git a/pkgs/development/python-modules/mock/default.nix b/pkgs/development/python-modules/mock/default.nix
index e12ed6d6b04b1..7e5a72a47fadd 100644
--- a/pkgs/development/python-modules/mock/default.nix
+++ b/pkgs/development/python-modules/mock/default.nix
@@ -1,40 +1,35 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
-, python
 , pythonOlder
-, pytest
-, unittestCheckHook
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "mock";
-  version = "4.0.3";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7d3fbbde18228f4ff2f1f119a45cdffa458b4c0dee32eb4d2bb2f82554bac7bc";
+    sha256 = "sha256-Xpaq1czaRxjgointlLICTfdcwtVVdbpXYtMfV2e4dn0=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/testing-cabal/mock/commit/f3e3d82aab0ede7e25273806dc0505574d85eae2.patch";
-      hash = "sha256-wPrv1/WeICZHn31UqFlICFsny2knvn3+Xg8BZoaGbwQ=";
-    })
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
-  nativeCheckInputs = [
-    unittestCheckHook
-    pytest
+  pythonImportsCheck = [
+    "mock"
   ];
 
   meta = with lib; {
-    description = "Mock objects for Python";
+    description = "Rolling backport of unittest.mock for all Pythons";
     homepage = "https://github.com/testing-cabal/mock";
+    changelog = "https://github.com/testing-cabal/mock/blob/${version}/CHANGELOG.rst";
     license = licenses.bsd2;
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index b029f9cad44e0..c30fc5311d040 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -79,6 +79,8 @@ buildPythonPackage rec {
     xmltodict
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     freezegun
     pytestCheckHook
diff --git a/pkgs/development/python-modules/ninja/default.nix b/pkgs/development/python-modules/ninja/default.nix
index d3ab12c29a55b..0ff6785693029 100644
--- a/pkgs/development/python-modules/ninja/default.nix
+++ b/pkgs/development/python-modules/ninja/default.nix
@@ -1,72 +1,47 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
-, fetchurl
-, cmake
-, setuptools-scm
-, scikit-build
-, pytestCheckHook
-, pytest-virtualenv
+, flit-core
+, ninja
 }:
-let
-  # these must match NinjaUrls.cmake
-  ninja_src_url = "https://github.com/Kitware/ninja/archive/v1.11.1.g95dee.kitware.jobserver-1.tar.gz";
-  ninja_src_sha256 = "7ba84551f5b315b4270dc7c51adef5dff83a2154a3665a6c9744245c122dd0db";
-  ninja_src = fetchurl {
-    url = ninja_src_url;
-    sha256 = ninja_src_sha256;
-  };
-in
+
 buildPythonPackage rec {
   pname = "ninja";
-  version = "1.11.1";
+  inherit (ninja) version;
   format = "pyproject";
 
-  src = fetchFromGitHub {
-    owner = "scikit-build";
-    repo = "ninja-python-distributions";
-    rev = version;
-    hash = "sha256-scCYsSEyN+u3qZhNhWYqHpJCl+JVJJbKz+T34gOXGJM=";
-  };
-  patches = [
-    # make sure cmake doesn't try to download the ninja sources
-    ./no-download.patch
-  ];
+  src = ./stub;
 
-  inherit ninja_src;
   postUnpack = ''
-    # assume that if the hash matches, the source should be fine
-    if ! grep "${ninja_src_sha256}" $sourceRoot/NinjaUrls.cmake; then
-      echo "ninja_src_sha256 doesn't match the hash in NinjaUrls.cmake!"
-      exit 1
-    fi
-    mkdir -p "$sourceRoot/Ninja-src"
-    pushd "$sourceRoot/Ninja-src"
-    tar -xavf ${ninja_src} --strip-components 1
-    popd
-  '';
+    substituteInPlace "$sourceRoot/pyproject.toml" \
+      --subst-var version
 
-  postPatch = ''
-    sed -i '/cov/d' setup.cfg
+    substituteInPlace "$sourceRoot/ninja/__init__.py" \
+      --subst-var-by BIN_DIR "${ninja}/bin"
   '';
 
-  dontUseCmakeConfigure = true;
+  inherit (ninja) setupHook;
 
   nativeBuildInputs = [
-    setuptools-scm
-    scikit-build
-    cmake
+    flit-core
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-virtualenv
+  preBuild = ''
+    cp "${ninja.src}/misc/ninja_syntax.py" ninja/ninja_syntax.py
+  '';
+
+  pythonImportsCheck = [
+    "ninja"
+    "ninja.ninja_syntax"
   ];
 
   meta = with lib; {
     description = "A small build system with a focus on speed";
+    longDescription = ''
+      This is a stub of the ninja package on PyPI that uses the ninja program
+      provided by nixpkgs instead of downloading ninja from the web.
+    '';
     homepage = "https://github.com/scikit-build/ninja-python-distributions";
     license = licenses.asl20;
-    maintainers = with maintainers; [ _999eagle ];
+    maintainers = with maintainers; [ _999eagle tjni ];
   };
 }
diff --git a/pkgs/development/python-modules/ninja/no-download.patch b/pkgs/development/python-modules/ninja/no-download.patch
deleted file mode 100644
index 0937a5fde1ea9..0000000000000
--- a/pkgs/development/python-modules/ninja/no-download.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -64,6 +64,7 @@
-   # Download selected source archive
-   ExternalProject_add(download_ninja_source
-     SOURCE_DIR ${Ninja_SOURCE_DIR}
-+    DOWNLOAD_COMMAND ""
-     URL ${${src_archive}_url}
-     URL_HASH SHA256=${${src_archive}_sha256}
-     DOWNLOAD_DIR ${ARCHIVE_DOWNLOAD_DIR}
diff --git a/pkgs/development/python-modules/ninja/stub/ninja/__init__.py b/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
new file mode 100644
index 0000000000000..fcf70f10ba310
--- /dev/null
+++ b/pkgs/development/python-modules/ninja/stub/ninja/__init__.py
@@ -0,0 +1,11 @@
+import os
+import subprocess
+import sys
+
+BIN_DIR = '@BIN_DIR@'
+
+def _program(name, args):
+    return subprocess.call([os.path.join(BIN_DIR, name)] + args, close_fds=False)
+
+def ninja():
+    raise SystemExit(_program('ninja', sys.argv[1:]))
diff --git a/pkgs/development/python-modules/ninja/stub/pyproject.toml b/pkgs/development/python-modules/ninja/stub/pyproject.toml
new file mode 100644
index 0000000000000..0a8a6314288a6
--- /dev/null
+++ b/pkgs/development/python-modules/ninja/stub/pyproject.toml
@@ -0,0 +1,11 @@
+[build-system]
+requires = ["flit_core"]
+build-backend = "flit_core.buildapi"
+
+[project]
+name = "ninja"
+version = "@version@"
+description = "Ninja is a small build system with a focus on speed"
+
+[project.scripts]
+ninja = "ninja:ninja"
diff --git a/pkgs/development/python-modules/nose2/default.nix b/pkgs/development/python-modules/nose2/default.nix
index b3dfdda218f33..648d954be7d04 100644
--- a/pkgs/development/python-modules/nose2/default.nix
+++ b/pkgs/development/python-modules/nose2/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     six
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   checkPhase = ''
     ${python.interpreter} -m unittest
   '';
diff --git a/pkgs/development/python-modules/nplusone/default.nix b/pkgs/development/python-modules/nplusone/default.nix
index ecf2255b3593d..5a31394c2d356 100644
--- a/pkgs/development/python-modules/nplusone/default.nix
+++ b/pkgs/development/python-modules/nplusone/default.nix
@@ -1,6 +1,7 @@
 { lib
 , blinker
 , buildPythonPackage
+, django
 , fetchFromGitHub
 , flake8
 , flask-sqlalchemy
@@ -79,5 +80,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/jmcarp/nplusone";
     maintainers = with maintainers; [ cript0nauta ];
     license = licenses.mit;
+    broken = lib.versionAtLeast django.version "4";
   };
 }
diff --git a/pkgs/development/python-modules/nvchecker/default.nix b/pkgs/development/python-modules/nvchecker/default.nix
index 20802a73176fa..ca327c3e54e0a 100644
--- a/pkgs/development/python-modules/nvchecker/default.nix
+++ b/pkgs/development/python-modules/nvchecker/default.nix
@@ -49,6 +49,8 @@ buildPythonPackage rec {
     tomli
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flaky
     pytest-asyncio
diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index bdcd705268696..934b65298f4e5 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.9.2";
+  version = "3.9.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,13 +25,13 @@ buildPythonPackage rec {
     owner = "ijl";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-uEwlrWPQbctCMiIz4fdXe2GDr2SSHaMzmYzzrECerxg=";
+    hash = "sha256-WS4qynQmJIVdDf0sYK/HFVQ+F5nfoJwx/zzmaL6YTRc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-U/WenkO7ecZQOGEppBlLtlXGtbpbS7e+Ic1hg/AnKSk=";
+    hash = "sha256-hGUXPTiKvKygxQzxXAO/+bD34eLnpkhQ7r/g27E+d4I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/oscrypto/default.nix b/pkgs/development/python-modules/oscrypto/default.nix
index 3f368ba7f1abe..92edbdf84eb9e 100644
--- a/pkgs/development/python-modules/oscrypto/default.nix
+++ b/pkgs/development/python-modules/oscrypto/default.nix
@@ -22,6 +22,10 @@ buildPythonPackage rec {
     hash = "sha256-CmDypmlc/kb6ONCUggjT1Iqd29xNSLRaGh5Hz36dvOw=";
   };
 
+  patches = [
+    ./support-openssl-3.0.10.patch
+  ];
+
   postPatch = ''
     for file in oscrypto/_openssl/_lib{crypto,ssl}_c{ffi,types}.py; do
       substituteInPlace $file \
diff --git a/pkgs/development/python-modules/oscrypto/support-openssl-3.0.10.patch b/pkgs/development/python-modules/oscrypto/support-openssl-3.0.10.patch
new file mode 100644
index 0000000000000..585eb64eaa473
--- /dev/null
+++ b/pkgs/development/python-modules/oscrypto/support-openssl-3.0.10.patch
@@ -0,0 +1,11 @@
+https://github.com/wbond/oscrypto/issues/75
+--- a/oscrypto/_openssl/_libcrypto_cffi.py
++++ b/oscrypto/_openssl/_libcrypto_cffi.py
+@@ -37,1 +37,1 @@
+-version_match = re.search('\\b(\\d\\.\\d\\.\\d[a-z]*)\\b', version_string)
++version_match = re.search('\\b(\\d\\.\\d\\.\\d+[a-z]*)\\b', version_string)
+--- a/oscrypto/_openssl/_libcrypto_ctypes.py
++++ b/oscrypto/_openssl/_libcrypto_ctypes.py
+@@ -40,1 +40,1 @@
+-version_match = re.search('\\b(\\d\\.\\d\\.\\d[a-z]*)\\b', version_string)
++version_match = re.search('\\b(\\d\\.\\d\\.\\d+[a-z]*)\\b', version_string)
diff --git a/pkgs/development/python-modules/prometheus-client/default.nix b/pkgs/development/python-modules/prometheus-client/default.nix
index aed4d5c5b258d..b3e1e12400c21 100644
--- a/pkgs/development/python-modules/prometheus-client/default.nix
+++ b/pkgs/development/python-modules/prometheus-client/default.nix
@@ -19,6 +19,8 @@ buildPythonPackage rec {
     hash = "sha256-ag9gun47Ar0Sw3ZGIXAHjtv4GdhX8x51UVkgwdQ8A+s=";
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index f2615499f7ba3..2676dc90d68ba 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -3,9 +3,11 @@
 , fetchpatch
 , isPyPy
 , lib
+, numpy
 , protobuf
 , pytestCheckHook
 , pythonAtLeast
+, substituteAll
 , tzdata
 }:
 
@@ -25,12 +27,19 @@ buildPythonPackage {
 
   sourceRoot = "${protobuf.src.name}/python";
 
-  patches = lib.optionals (pythonAtLeast "3.11") [
+  patches = lib.optionals (lib.versionAtLeast protobuf.version "3.22") [
+    # Replace the vendored abseil-cpp with nixpkgs'
+    (substituteAll {
+      src = ./use-nixpkgs-abseil-cpp.patch;
+      abseil_cpp_include_path = "${lib.getDev protobuf.abseil-cpp}/include";
+    })
+  ]
+  ++ lib.optionals (pythonAtLeast "3.11" && lib.versionOlder protobuf.version "3.22") [
     (fetchpatch {
-      url = "https://github.com/protocolbuffers/protobuf/commit/da973aff2adab60a9e516d3202c111dbdde1a50f.patch";
-      stripLen = 2;
-      extraPrefix = "";
-      hash = "sha256-a/12C6yIe1tEKjsMxcfDAQ4JHolA8CzkN7sNG8ZspPs=";
+      name = "support-python311.patch";
+      url = "https://github.com/protocolbuffers/protobuf/commit/2206b63c4649cf2e8a06b66c9191c8ef862ca519.diff";
+      stripLen = 1; # because sourceRoot above
+      hash = "sha256-3GaoEyZIhS3QONq8LEvJCH5TdO9PKnOgcQF0GlEiwFo=";
     })
   ];
 
@@ -41,6 +50,19 @@ buildPythonPackage {
     fi
   '';
 
+  # Remove the line in setup.py that forces compiling with C++14. Upstream's
+  # CMake build has been updated to support compiling with other versions of
+  # C++, but the Python build has not. Without this, we observe compile-time
+  # errors using GCC.
+  #
+  # Fedora appears to do the same, per this comment:
+  #
+  #   https://github.com/protocolbuffers/protobuf/issues/12104#issuecomment-1542543967
+  #
+  postPatch = ''
+    sed -i "/extra_compile_args.append('-std=c++14')/d" setup.py
+  '';
+
   nativeBuildInputs = lib.optional isPyPy tzdata;
 
   buildInputs = [ protobuf ];
@@ -54,6 +76,8 @@ buildPythonPackage {
 
   nativeCheckInputs = [
     pytestCheckHook
+  ] ++ lib.optionals (lib.versionAtLeast protobuf.version "3.22") [
+    numpy
   ];
 
   disabledTests = lib.optionals isPyPy [
@@ -66,6 +90,18 @@ buildPythonPackage {
     "testStrictUtf8Check"
   ];
 
+  disabledTestPaths = lib.optionals (lib.versionAtLeast protobuf.version "3.23") [
+    # The following commit (I think) added some internal test logic for Google
+    # that broke generator_test.py. There is a new proto file that setup.py is
+    # not generating into a .py file. However, adding this breaks a bunch of
+    # conflict detection in descriptor_test.py that I don't understand. So let's
+    # just disable generator_test.py for now.
+    #
+    #   https://github.com/protocolbuffers/protobuf/commit/5abab0f47e81ac085f0b2d17ec3b3a3b252a11f1
+    #
+    "google/protobuf/internal/generator_test.py"
+  ];
+
   pythonImportsCheck = [
     "google.protobuf"
     "google.protobuf.internal._api_implementation" # Verify that --cpp_implementation worked
diff --git a/pkgs/development/python-modules/protobuf/use-nixpkgs-abseil-cpp.patch b/pkgs/development/python-modules/protobuf/use-nixpkgs-abseil-cpp.patch
new file mode 100644
index 0000000000000..cbc92bb76ab85
--- /dev/null
+++ b/pkgs/development/python-modules/protobuf/use-nixpkgs-abseil-cpp.patch
@@ -0,0 +1,13 @@
+diff --git a/setup.py b/setup.py
+index e65631013..d511c2996 100755
+--- a/setup.py
++++ b/setup.py
+@@ -412,7 +412,7 @@ if __name__ == '__main__':
+         Extension(
+             'google.protobuf.pyext._message',
+             glob.glob('google/protobuf/pyext/*.cc'),
+-            include_dirs=['.', '../src', '../third_party/abseil-cpp'],
++            include_dirs=['.', '../src', '@abseil_cpp_include_path@'],
+             libraries=libraries,
+             extra_objects=extra_objects,
+             extra_link_args=message_extra_link_args,
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 45e5d8f13a151..cacb67496c8ca 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -46,6 +46,8 @@ buildPythonPackage rec {
     curl
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     bottle
     pytestCheckHook
diff --git a/pkgs/development/python-modules/pyquery/default.nix b/pkgs/development/python-modules/pyquery/default.nix
index 4e3b1442ee317..699bcd0fbc592 100644
--- a/pkgs/development/python-modules/pyquery/default.nix
+++ b/pkgs/development/python-modules/pyquery/default.nix
@@ -33,6 +33,8 @@ buildPythonPackage rec {
     lxml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "pyquery" ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/pyro5/default.nix b/pkgs/development/python-modules/pyro5/default.nix
index 7c469595ab74f..93ea78d692c8f 100644
--- a/pkgs/development/python-modules/pyro5/default.nix
+++ b/pkgs/development/python-modules/pyro5/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     serpent
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/pytest-recording/default.nix b/pkgs/development/python-modules/pytest-recording/default.nix
index fe68e9ee46b08..87c0e8d33a026 100644
--- a/pkgs/development/python-modules/pytest-recording/default.nix
+++ b/pkgs/development/python-modules/pytest-recording/default.nix
@@ -33,6 +33,8 @@ buildPythonPackage rec {
     attrs
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   checkInputs = [
     pytestCheckHook
     pytest-httpbin
diff --git a/pkgs/development/python-modules/pytest-remotedata/default.nix b/pkgs/development/python-modules/pytest-remotedata/default.nix
index 544a2e3400799..bc8c89caacc14 100644
--- a/pkgs/development/python-modules/pytest-remotedata/default.nix
+++ b/pkgs/development/python-modules/pytest-remotedata/default.nix
@@ -32,6 +32,8 @@ buildPythonPackage rec {
     six
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/pytest-tornasync/default.nix b/pkgs/development/python-modules/pytest-tornasync/default.nix
index ac2cf07736c5c..9fca8d8602620 100644
--- a/pkgs/development/python-modules/pytest-tornasync/default.nix
+++ b/pkgs/development/python-modules/pytest-tornasync/default.nix
@@ -21,6 +21,8 @@ buildPythonPackage rec {
     tornado
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest
     tornado
diff --git a/pkgs/development/python-modules/pywemo/default.nix b/pkgs/development/python-modules/pywemo/default.nix
index 6a643979715d4..a2fc6c4bd2799 100644
--- a/pkgs/development/python-modules/pywemo/default.nix
+++ b/pkgs/development/python-modules/pywemo/default.nix
@@ -37,6 +37,8 @@ buildPythonPackage rec {
     lxml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     hypothesis
     pytest-vcr
diff --git a/pkgs/development/python-modules/pyzipper/default.nix b/pkgs/development/python-modules/pyzipper/default.nix
index d12e396e2db16..a0ad73fb8a3b4 100644
--- a/pkgs/development/python-modules/pyzipper/default.nix
+++ b/pkgs/development/python-modules/pyzipper/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage rec {
     pycryptodomex
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/rangehttpserver/default.nix b/pkgs/development/python-modules/rangehttpserver/default.nix
index 010b959edad3e..bab8f73b412b0 100644
--- a/pkgs/development/python-modules/rangehttpserver/default.nix
+++ b/pkgs/development/python-modules/rangehttpserver/default.nix
@@ -22,6 +22,8 @@ buildPythonPackage rec {
     setuptools
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
     requests
diff --git a/pkgs/development/python-modules/responses/default.nix b/pkgs/development/python-modules/responses/default.nix
index a1e21b8fbcdc2..a35b03680a448 100644
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.23.1";
+  version = "0.23.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-BU90nUZVqowFMn78KfbBEf59X7Q/1itvkGFdOzy4D2c=";
+    hash = "sha256-VJmcRMn0O+3mDwzkCwxIX7RU3/I9T9p9N8t6USWDZJQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rope/default.nix b/pkgs/development/python-modules/rope/default.nix
index 3a9c947a118d1..1168529eea683 100644
--- a/pkgs/development/python-modules/rope/default.nix
+++ b/pkgs/development/python-modules/rope/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     pytoolconfig
   ] ++ pytoolconfig.optional-dependencies.global;
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-timeout
     pytestCheckHook
diff --git a/pkgs/development/python-modules/scikit-build-core/default.nix b/pkgs/development/python-modules/scikit-build-core/default.nix
index c3fac4ea34df0..bf0d3b28c9bb7 100644
--- a/pkgs/development/python-modules/scikit-build-core/default.nix
+++ b/pkgs/development/python-modules/scikit-build-core/default.nix
@@ -74,6 +74,12 @@ buildPythonPackage rec {
     "tests/test_setuptools_pep518.py"
   ];
 
+  # Tries to access ninja.__version__ which our stub doesn't have.
+  # FIXME: remove for next cycle
+  disabledTests = [
+    "test_get_ninja_programs_cmake_module"
+  ];
+
   pythonImportsCheck = [
     "scikit_build_core"
   ];
diff --git a/pkgs/development/python-modules/snakeviz/default.nix b/pkgs/development/python-modules/snakeviz/default.nix
index 0b37679449853..1b8c1c81183bd 100644
--- a/pkgs/development/python-modules/snakeviz/default.nix
+++ b/pkgs/development/python-modules/snakeviz/default.nix
@@ -31,6 +31,8 @@ buildPythonPackage rec {
     tornado
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     ipython
     pytestCheckHook
diff --git a/pkgs/development/python-modules/sockio/default.nix b/pkgs/development/python-modules/sockio/default.nix
index 5e1fcbe2a7f1c..8ce561b781f93 100644
--- a/pkgs/development/python-modules/sockio/default.nix
+++ b/pkgs/development/python-modules/sockio/default.nix
@@ -27,6 +27,8 @@ buildPythonPackage rec {
       --replace "--durations=2 --verbose" ""
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-asyncio
     pytestCheckHook
diff --git a/pkgs/development/python-modules/sshfs/default.nix b/pkgs/development/python-modules/sshfs/default.nix
index 653b30f14d0c9..f1b47d75b8c50 100644
--- a/pkgs/development/python-modules/sshfs/default.nix
+++ b/pkgs/development/python-modules/sshfs/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , asyncssh
 , bcrypt
 , buildPythonPackage
@@ -7,6 +8,7 @@
 , mock-ssh-server
 , pytest-asyncio
 , pytestCheckHook
+, setuptools
 , setuptools-scm
 }:
 
@@ -24,6 +26,7 @@ buildPythonPackage rec {
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
@@ -33,12 +36,19 @@ buildPythonPackage rec {
     fsspec
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     mock-ssh-server
     pytest-asyncio
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals stdenv.isDarwin [
+    # test fails with sandbox enabled
+    "test_checksum"
+  ];
+
   pythonImportsCheck = [
     "sshfs"
   ];
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index 8d16f6921d2f8..348f5197a9d6e 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -448,7 +448,10 @@ let
       license = licenses.asl20;
       maintainers = with maintainers; [ abbradar ];
       platforms = with platforms; linux ++ darwin;
-      broken = !(xlaSupport -> cudaSupport) || python.pythonVersion == "3.11";
+      # More vulnerabilities in 2.11.1 really; https://github.com/tensorflow/tensorflow/releases
+      knownVulnerabilities = [ "CVE-2023-33976" ];
+      broken = true || # most likely needs dealing with protobuf/abseil updates
+        !(xlaSupport -> cudaSupport) || python.pythonVersion == "3.11";
     } // lib.optionalAttrs stdenv.isDarwin {
       timeout = 86400; # 24 hours
       maxSilent = 14400; # 4h, double the default of 7200s
diff --git a/pkgs/development/python-modules/terminado/default.nix b/pkgs/development/python-modules/terminado/default.nix
index 1031ff5b14231..3c75305e9078f 100644
--- a/pkgs/development/python-modules/terminado/default.nix
+++ b/pkgs/development/python-modules/terminado/default.nix
@@ -31,12 +31,13 @@ buildPythonPackage rec {
     "terminado"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-timeout
     pytestCheckHook
   ];
 
-
   meta = with lib; {
     description = "Terminals served by Tornado websockets";
     homepage = "https://github.com/jupyter/terminado";
diff --git a/pkgs/development/python-modules/umodbus/default.nix b/pkgs/development/python-modules/umodbus/default.nix
index 331a4b1306d29..7ce4997342036 100644
--- a/pkgs/development/python-modules/umodbus/default.nix
+++ b/pkgs/development/python-modules/umodbus/default.nix
@@ -25,6 +25,8 @@ buildPythonPackage rec {
     pyserial
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/unearth/default.nix b/pkgs/development/python-modules/unearth/default.nix
index cf9e95e41bb29..f1a61014e4968 100644
--- a/pkgs/development/python-modules/unearth/default.nix
+++ b/pkgs/development/python-modules/unearth/default.nix
@@ -36,6 +36,8 @@ buildPythonPackage rec {
     cached-property
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     flask
     pytest-httpserver
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index fa57b00728929..25f7e4b98dd91 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -97,6 +97,8 @@ buildPythonPackage rec {
     shortuuid
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     azure-containerregistry
     azure-core
diff --git a/pkgs/development/python-modules/wsgidav/default.nix b/pkgs/development/python-modules/wsgidav/default.nix
index f1b81599c396e..9dc51364bc654 100644
--- a/pkgs/development/python-modules/wsgidav/default.nix
+++ b/pkgs/development/python-modules/wsgidav/default.nix
@@ -40,6 +40,8 @@ buildPythonPackage rec {
     pyyaml
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     cheroot
     pytestCheckHook
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index da157c30a1504..2a9ad50c80441 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.17";
-  source.sha256 = "sha256-2EV6XnbJ0VPUuw/R/9Kj9Y+/CQyzRIub16Ah0T8ORK0=";
+  version = "2.4.18";
+  source.sha256 = "sha256-tvfScSHUmHSmnJGU1PjvVWsjkMzuxBY1zPTzxYBp9w4=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch b/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
deleted file mode 100644
index 2de9484226b12..0000000000000
--- a/pkgs/development/tools/build-managers/meson/darwin-case-sensitive-fs.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 1643ed0d8a9201732905bee51b096605d26aaaac Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Fri, 26 May 2023 00:10:45 -0400
-Subject: [PATCH] Fix test failures on Darwin on a case-sensitive fs
-
-This issue was encounetered while working on a contribution to nixpkgs.
-Nix allows the store to be installed on a separate, case-sensitive APFS
-volume. When the store is on a case-sensitive volume, these tests fail
-because they try to use `foundation` instead of `Foundation`.
----
- .../failing/78 framework dependency with version/meson.build    | 2 +-
- test cases/objc/2 nsstring/meson.build                          | 2 +-
- test cases/osx/6 multiframework/meson.build                     | 2 +-
- 3 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/test cases/failing/78 framework dependency with version/meson.build b/test cases/failing/78 framework dependency with version/meson.build
-index b7e04bab446..ee315ebcbd7 100644
---- a/test cases/failing/78 framework dependency with version/meson.build	
-+++ b/test cases/failing/78 framework dependency with version/meson.build	
-@@ -5,4 +5,4 @@ if host_machine.system() != 'darwin'
- endif
- 
- # do individual frameworks have a meaningful version to test?  And multiple frameworks might be listed...
--dep = dependency('appleframeworks', modules: 'foundation', version: '>0')
-+dep = dependency('appleframeworks', modules: 'Foundation', version: '>0')
-diff --git a/test cases/objc/2 nsstring/meson.build b/test cases/objc/2 nsstring/meson.build
-index 94d2cf18ab4..2c483d50d68 100644
---- a/test cases/objc/2 nsstring/meson.build	
-+++ b/test cases/objc/2 nsstring/meson.build	
-@@ -1,7 +1,7 @@
- project('nsstring', 'objc')
- 
- if host_machine.system() == 'darwin'
--  dep = dependency('appleframeworks', modules : 'foundation')
-+  dep = dependency('appleframeworks', modules : 'Foundation')
- elif host_machine.system() == 'cygwin'
-   error('MESON_SKIP_TEST GNUstep is not packaged for Cygwin.')
- else
-diff --git a/test cases/osx/6 multiframework/meson.build b/test cases/osx/6 multiframework/meson.build
-index 28846243b21..57e5d61560b 100644
---- a/test cases/osx/6 multiframework/meson.build	
-+++ b/test cases/osx/6 multiframework/meson.build	
-@@ -4,7 +4,7 @@ project('multiframework', 'objc')
- # that causes a build failure when defining two modules. The
- # arguments for the latter module overwrote the arguments for
- # the first one rather than adding to them.
--cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'foundation'])
-+cocoa_dep = dependency('appleframeworks', modules : ['AppKit', 'Foundation'])
- 
- executable('deptester',
-   'main.m',
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 58468ccee5b81..aa09a5d2358ed 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchPypi
+, fetchFromGitHub
 , fetchpatch
 , installShellFiles
 , ninja
@@ -18,18 +18,16 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.1.1";
+  version = "1.2.0";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-0EtUH5fKQ5+4L6t9DUgJiL5L1OYlY6XKNfrbVAByexw=";
+  src = fetchFromGitHub {
+    owner = "mesonbuild";
+    repo = "meson";
+    rev = "refs/tags/${version}";
+    hash = "sha256-bJAmkE+sL9DqKpcjZdBf4/z9lz+m/o0Z87hlAwbVbTY=";
   };
 
   patches = [
-    # Fix Meson tests that fail when the Nix store is case-sensitive APFS.
-    # https://github.com/mesonbuild/meson/pull/11820
-    ./darwin-case-sensitive-fs.patch
-
     # Meson is currently inspecting fewer variables than autoconf does, which
     # makes it harder for us to use setup hooks, etc.  Taken from
     # https://github.com/mesonbuild/meson/pull/6827
diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 4e776b34ded3c..a1e543f30fa04 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -10,24 +10,40 @@ stdenv.mkDerivation rec {
   };
 
   patches = let
-    dp = { ver ? "1%255.18.16-4", pname, name ? (pname + ".diff"), sha256 }: fetchurl {
+    dp = { ver ? "1%255.18.16-5", name, sha256 }: fetchurl {
       url = "https://salsa.debian.org/debian/autogen/-/raw/debian/${ver}"
-          + "/debian/patches/${pname}.diff?inline=false";
+          + "/debian/patches/${name}?inline=false";
       inherit name sha256;
     };
   in [
     (dp {
-      pname = "20_no_Werror";
+      name = "20_no_Werror.diff";
       sha256 = "08z4s2ifiqyaacjpd9pzr59w8m4j3548kkaq1bwvp2gjn29m680x";
     })
     (dp {
-      pname = "30_ag_macros.m4_syntax_error";
+      name = "30_ag_macros.m4_syntax_error.diff";
       sha256 = "1z8vmbwbkz3505wd33i2xx91mlf8rwsa7klndq37nw821skxwyh3";
     })
     (dp {
-      pname = "31_allow_overriding_AGexe_for_crossbuild";
+      name = "31_allow_overriding_AGexe_for_crossbuild.diff";
       sha256 = "0h9wkc9bqb509knh8mymi43hg6n6sxg2lixvjlchcx7z0j7p8xkf";
     })
+    (dp {
+      name = "40_suse_01-autogen-catch-race-error.patch";
+      sha256 = "1cfkym2zds1f85md1m74snxzqmzlj7wd5jivgmyl342856848xav";
+    })
+    (dp {
+      name = "40_suse_03-gcc9-fix-wrestrict.patch";
+      sha256 = "1ifdwi6gf96jc78jw7q4bfi5fgdldlf2nl55y20h6xb78kv0pznd";
+    })
+    (dp {
+      name = "40_suse_05-sprintf-overflow.patch";
+      sha256 = "136m62k68w1h5k7iapynvbyipidw35js6pq21lsc6rpxvgp0n469";
+    })
+    (dp {
+      name = "40_suse_06-autogen-avoid-GCC-code-analysis-bug.patch";
+      sha256 = "1d65zygzw2rpa00s0jy2y1bg29vkbhnjwlb5pv22rfv87zbk6z9q";
+    })
     # Next upstream release will contain guile-3 support. We apply non-invasive
     # patch meanwhile.
     (fetchpatch {
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index a88bd9f0b3bbc..93d61b638bea3 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -10,6 +10,7 @@
 , enableDebuginfod ? lib.meta.availableOn stdenv.hostPlatform elfutils, elfutils
 , guile ? null
 , hostCpuOnly ? false
+, enableSim ? false
 , safePaths ? [
    # $debugdir:$datadir/auto-load are whitelisted by default by GDB
    "$debugdir" "$datadir/auto-load"
@@ -113,7 +114,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (!pythonSupport) "--without-python"
     ++ lib.optional stdenv.hostPlatform.isMusl "--disable-nls"
     ++ lib.optional stdenv.hostPlatform.isStatic "--disable-inprocess-agent"
-    ++ lib.optional enableDebuginfod "--with-debuginfod=yes";
+    ++ lib.optional enableDebuginfod "--with-debuginfod=yes"
+    ++ lib.optional (!enableSim) "--disable-sim";
 
   postInstall =
     '' # Remove Info files already provided by Binutils and other packages.
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index e44241171c60b..3ac338d5c619d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -1,5 +1,17 @@
-{ lib, appleDerivation, xcbuild, ncurses, libutil, Libc }:
+{ stdenv, lib, appleDerivation, xcbuild, ncurses, libutil, Libc }:
 
+let
+  # Libc conflicts with libc++ 16, so provide only the header from it that’s needed to build.
+  msgcat = stdenv.mkDerivation {
+    pname = "Libc-msgcat";
+    version = lib.getVersion Libc;
+
+    buildCommand = ''
+      mkdir -p "$out/include"
+      ln -s ${lib.getDev Libc}/include/msgcat.h "$out/include/"
+    '';
+  };
+in
 appleDerivation {
   # We can't just run the root build, because https://github.com/facebook/xcbuild/issues/264
 
@@ -44,7 +56,7 @@ appleDerivation {
   '';
 
   nativeBuildInputs = [ xcbuild ];
-  buildInputs = [ ncurses libutil Libc ];
+  buildInputs = [ ncurses libutil msgcat ];
 
   meta = {
     platforms = lib.platforms.darwin;
diff --git a/pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix b/pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix
new file mode 100644
index 0000000000000..13595e3771a7a
--- /dev/null
+++ b/pkgs/os-specific/darwin/signing-utils/post-link-sign-hook.nix
@@ -0,0 +1,13 @@
+{ writeTextFile, cctools, sigtool }:
+
+writeTextFile {
+  name = "post-link-sign-hook";
+  executable = true;
+
+  text = ''
+    if [ "$linkerOutput" != "/dev/null" ]; then
+      CODESIGN_ALLOCATE=${cctools}/bin/${cctools.targetPrefix}codesign_allocate \
+        ${sigtool}/bin/codesign -f -s - "$linkerOutput"
+    fi
+  '';
+}
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index e04fa843f0f2c..c8ae911c12872 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -36,7 +36,10 @@ let
 
     debug = {
       # Necessary for BTF
-      DEBUG_INFO                = yes;
+      DEBUG_INFO                = mkMerge [
+        (whenOlder "5.2" (if (features.debug or false) then yes else no))
+        (whenBetween "5.2" "5.18" yes)
+      ];
       DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT = whenAtLeast "5.18" yes;
       # Reduced debug info conflict with BTF and have been enabled in
       # aarch64 defconfig since 5.13
@@ -59,8 +62,6 @@ let
       SUNRPC_DEBUG              = yes;
       # Provide access to tunables like sched_migration_cost_ns
       SCHED_DEBUG               = yes;
-
-      GDB_SCRIPTS               = yes;
     };
 
     power-management = {
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index ade256802d6ef..a21890a38ca20 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -47,7 +47,7 @@
   # symbolic name and `patch' is the actual patch.  The patch may
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
-, ignoreConfigErrors ? stdenv.hostPlatform.linux-kernel.name or "" != "pc"
+, ignoreConfigErrors ? stdenv.hostPlatform.linux-kernel.name != "pc"
 , extraMeta ? {}
 
 , isZen      ? false
@@ -55,7 +55,7 @@
 , isHardened ? false
 
 # easy overrides to stdenv.hostPlatform.linux-kernel members
-, autoModules ? stdenv.hostPlatform.linux-kernel.autoModules or true
+, autoModules ? stdenv.hostPlatform.linux-kernel.autoModules
 , preferBuiltin ? stdenv.hostPlatform.linux-kernel.preferBuiltin or false
 , kernelArch ? stdenv.hostPlatform.linuxArch
 , kernelTests ? []
@@ -128,8 +128,11 @@ let
       ++ lib.optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ lib.optional (lib.versionAtLeast version "5.2") pahole;
 
+    platformName = stdenv.hostPlatform.linux-kernel.name;
     # e.g. "defconfig"
-    kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig or "defconfig";
+    kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig;
+    # e.g. "bzImage"
+    kernelTarget = stdenv.hostPlatform.linux-kernel.target;
 
     makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
       ++ extraMakeFlags;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 07325f0e10b07..61013ef090af0 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
-, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, ubootTools
+, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole
 , fetchpatch
 }:
 
@@ -52,10 +52,6 @@ in lib.makeOverridable ({
   features ? null, lib ? lib_, stdenv ? stdenv_,
 }:
 
-let
-  config_ = config;
-in
-
 let
   inherit (lib)
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
@@ -69,144 +65,315 @@ let
     (buildPackages.deterministic-uname.override { inherit modDirVersion; })
   ] ++ optional (lib.versionAtLeast version "5.13") zstd;
 
-  config = let attrName = attr: "CONFIG_" + attr; in {
-    isSet = attr: hasAttr (attrName attr) config;
-
-    getValue = attr: if config.isSet attr then getAttr (attrName attr) config else null;
-
-    isYes = attr: (config.getValue attr) == "y";
-
-    isNo = attr: (config.getValue attr) == "n";
-
-    isModule = attr: (config.getValue attr) == "m";
-
-    isEnabled = attr: (config.isModule attr) || (config.isYes attr);
-
-    isDisabled = attr: (!(config.isSet attr)) || (config.isNo attr);
-  } // config_;
-
-  isModular = config.isYes "MODULES";
-
-  kernelConf = stdenv.hostPlatform.linux-kernel;
-  target = kernelConf.target or "vmlinux";
-
-  buildDTBs = kernelConf.DTB or false;
+  drvAttrs = config_: kernelConf: kernelPatches: configfile:
+    let
+      config = let attrName = attr: "CONFIG_" + attr; in {
+        isSet = attr: hasAttr (attrName attr) config;
+
+        getValue = attr: if config.isSet attr then getAttr (attrName attr) config else null;
+
+        isYes = attr: (config.getValue attr) == "y";
+
+        isNo = attr: (config.getValue attr) == "n";
+
+        isModule = attr: (config.getValue attr) == "m";
+
+        isEnabled = attr: (config.isModule attr) || (config.isYes attr);
+
+        isDisabled = attr: (!(config.isSet attr)) || (config.isNo attr);
+      } // config_;
+
+      isModular = config.isYes "MODULES";
+
+      buildDTBs = kernelConf.DTB or false;
+
+    in (optionalAttrs isModular { outputs = [ "out" "dev" ]; }) // {
+      passthru = rec {
+        inherit version modDirVersion config kernelPatches configfile
+          moduleBuildDependencies stdenv;
+        inherit isZen isHardened isLibre;
+        isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
+        baseVersion = lib.head (lib.splitString "-rc" version);
+        kernelOlder = lib.versionOlder baseVersion;
+        kernelAtLeast = lib.versionAtLeast baseVersion;
+      };
+
+      inherit src;
+
+      patches =
+        map (p: p.patch) kernelPatches
+        # Required for deterministic builds along with some postPatch magic.
+        ++ optional (lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
+        ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
+        # Linux 5.12 marked certain PowerPC-only symbols as GPL, which breaks
+        # OpenZFS; this was fixed in Linux 5.19 so we backport the fix
+        # https://github.com/openzfs/zfs/pull/13367
+        ++ optional (lib.versionAtLeast version "5.12" &&
+                     lib.versionOlder version "5.19" &&
+                     stdenv.hostPlatform.isPower)
+          (fetchpatch {
+            url = "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/patch/?id=d9e5c3e9e75162f845880535957b7fd0b4637d23";
+            hash = "sha256-bBOyJcP6jUvozFJU0SPTOf3cmnTQ6ZZ4PlHjiniHXLU=";
+          });
+
+      postPatch = ''
+        sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
+
+        # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
+        # FIXME: remove when no longer needed
+        substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
+
+        # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
+        # This way kernels can be bit-by-bit reproducible depending on settings
+        # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled).
+        # See also https://kernelnewbies.org/BuildId
+        sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
+
+        # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
+        [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
+
+        # Set randstruct seed to a deterministic but diversified value. Note:
+        # we could have instead patched gen-random-seed.sh to take input from
+        # the buildFlags, but that would require also patching the kernel's
+        # toplevel Makefile to add a variable export. This would be likely to
+        # cause future patch conflicts.
+        for file in scripts/gen-randstruct-seed.sh scripts/gcc-plugins/gen-random-seed.sh; do
+          if [ -f "$file" ]; then
+            substituteInPlace "$file" \
+              --replace NIXOS_RANDSTRUCT_SEED \
+              $(echo ${randstructSeed}${src} ${placeholder "configfile"} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
+            break
+          fi
+        done
+
+        patchShebangs scripts
+
+        # also patch arch-specific install scripts
+        for i in $(find arch -name install.sh); do
+            patchShebangs "$i"
+        done
+      '';
+
+      configurePhase = ''
+        runHook preConfigure
+
+        mkdir build
+        export buildRoot="$(pwd)/build"
+
+        echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
+
+        if [ -f "$buildRoot/.config" ]; then
+          echo "Could not link $buildRoot/.config : file exists"
+          exit 1
+        fi
+        ln -sv ${configfile} $buildRoot/.config
+
+        # reads the existing .config file and prompts the user for options in
+        # the current kernel source that are not found in the file.
+        make $makeFlags "''${makeFlagsArray[@]}" oldconfig
+        runHook postConfigure
+
+        make $makeFlags "''${makeFlagsArray[@]}" prepare
+        actualModDirVersion="$(cat $buildRoot/include/config/kernel.release)"
+        if [ "$actualModDirVersion" != "${modDirVersion}" ]; then
+          echo "Error: modDirVersion ${modDirVersion} specified in the Nix expression is wrong, it should be: $actualModDirVersion"
+          exit 1
+        fi
+
+        buildFlagsArray+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
+
+        cd $buildRoot
+      '';
+
+      buildFlags = [
+        "KBUILD_BUILD_VERSION=1-NixOS"
+        kernelConf.target
+        "vmlinux"  # for "perf" and things like that
+      ] ++ optional isModular "modules"
+        ++ optionals buildDTBs ["dtbs" "DTC_FLAGS=-@"]
+      ++ extraMakeFlags;
+
+      installFlags = [
+        "INSTALL_PATH=$(out)"
+      ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
+      ++ optionals buildDTBs ["dtbs_install" "INSTALL_DTBS_PATH=$(out)/dtbs"];
+
+      preInstall = let
+        # All we really need to do here is copy the final image and System.map to $out,
+        # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
+        # for the rest. Easy, right?
+        #
+        # Unfortunately for us, the obvious way of getting the built image path,
+        # make -s image_name, does not work correctly, because some architectures
+        # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
+        # so we end up attempting to install the thing we didn't actually build.
+        #
+        # Thankfully, there's a way out that doesn't involve just hardcoding everything.
+        #
+        # The kernel has an install target, which runs a pretty simple shell script
+        # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
+        # which kernel version you're looking at) that tries to do something sensible.
+        #
+        # (it would be great to hijack this script immediately, as it has all the
+        #   information we need passed to it and we don't need it to try and be smart,
+        #   but unfortunately, the exact location of the scripts differs between kernel
+        #   versions, and they're seemingly not considered to be public API at all)
+        #
+        # One of the ways it tries to discover what "something sensible" actually is
+        # is by delegating to what's supposed to be a user-provided install script
+        # located at ~/bin/installkernel.
+        #
+        # (the other options are:
+        #   - a distribution-specific script at /sbin/installkernel,
+        #        which we can't really create in the sandbox easily
+        #   - an architecture-specific script at arch/$arch/boot/install.sh,
+        #        which attempts to guess _something_ and usually guesses very wrong)
+        #
+        # More specifically, the install script exec's into ~/bin/installkernel, if one
+        # exists, with the following arguments:
+        #
+        # $1: $KERNELRELEASE - full kernel version string
+        # $2: $KBUILD_IMAGE - the final image path
+        # $3: System.map - path to System.map file, seemingly hardcoded everywhere
+        # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
+        #
+        # $2 is exactly what we want, so hijack the script and use the knowledge given to it
+        # by the makefile overlords for our own nefarious ends.
+        #
+        # Note that the makefiles specifically look in ~/bin/installkernel, and
+        # writeShellScriptBin writes the script to <store path>/bin/installkernel,
+        # so HOME needs to be set to just the store path.
+        #
+        # FIXME: figure out a less roundabout way of doing this.
+        installkernel = buildPackages.writeShellScriptBin "installkernel" ''
+          cp -av $2 $4
+          cp -av $3 $4
+        '';
+      in ''
+        installFlagsArray+=("-j$NIX_BUILD_CORES")
+        export HOME=${installkernel}
+      '';
+
+      # Some image types need special install targets (e.g. uImage is installed with make uinstall)
+      installTargets = [
+        (kernelConf.installTarget or (
+          /**/ if kernelConf.target == "uImage" then "uinstall"
+          else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" then "zinstall"
+          else "install"))
+      ];
+
+      postInstall = optionalString isModular ''
+        mkdir -p $dev
+        cp vmlinux $dev/
+        if [ -z "''${dontStrip-}" ]; then
+          installFlagsArray+=("INSTALL_MOD_STRIP=1")
+        fi
+        make modules_install $makeFlags "''${makeFlagsArray[@]}" \
+          $installFlags "''${installFlagsArray[@]}"
+        unlink $out/lib/modules/${modDirVersion}/build
+        unlink $out/lib/modules/${modDirVersion}/source
+
+        mkdir -p $dev/lib/modules/${modDirVersion}/{build,source}
+
+        # To save space, exclude a bunch of unneeded stuff when copying.
+        (cd .. && rsync --archive --prune-empty-dirs \
+            --exclude='/build/' \
+            * $dev/lib/modules/${modDirVersion}/source/)
+
+        cd $dev/lib/modules/${modDirVersion}/source
+
+        cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
+        make modules_prepare $makeFlags "''${makeFlagsArray[@]}" O=$dev/lib/modules/${modDirVersion}/build
+
+        # For reproducibility, removes accidental leftovers from a `cc1` call
+        # from a `try-run` call from the Makefile
+        rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
+
+        # Keep some extra files on some arches (powerpc, aarch64)
+        for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o; do
+          if [ -f "$buildRoot/$f" ]; then
+            cp $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
+          fi
+        done
+
+        # !!! No documentation on how much of the source tree must be kept
+        # If/when kernel builds fail due to missing files, you can add
+        # them here. Note that we may see packages requiring headers
+        # from drivers/ in the future; it adds 50M to keep all of its
+        # headers on 3.10 though.
+
+        chmod u+w -R ..
+        arch=$(cd $dev/lib/modules/${modDirVersion}/build/arch; ls)
+
+        # Remove unused arches
+        for d in $(cd arch/; ls); do
+          if [ "$d" = "$arch" ]; then continue; fi
+          if [ "$arch" = arm64 ] && [ "$d" = arm ]; then continue; fi
+          rm -rf arch/$d
+        done
+
+        # Remove all driver-specific code (50M of which is headers)
+        rm -fR drivers
+
+        # Keep all headers
+        find .  -type f -name '*.h' -print0 | xargs -0 -r chmod u-w
+
+        # Keep linker scripts (they are required for out-of-tree modules on aarch64)
+        find .  -type f -name '*.lds' -print0 | xargs -0 -r chmod u-w
+
+        # Keep root and arch-specific Makefiles
+        chmod u-w Makefile arch/"$arch"/Makefile*
+
+        # Keep whole scripts dir
+        chmod u-w -R scripts
+
+        # Delete everything not kept
+        find . -type f -perm -u=w -print0 | xargs -0 -r rm
+
+        # Delete empty directories
+        find -empty -type d -delete
+
+        # Remove reference to kmod
+        sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
+      '';
+
+      requiredSystemFeatures = [ "big-parallel" ];
+
+      meta = {
+        description =
+          "The Linux kernel" +
+          (if kernelPatches == [] then "" else
+            " (with patches: "
+            + lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
+            + ")");
+        license = lib.licenses.gpl2Only;
+        homepage = "https://www.kernel.org/";
+        maintainers = lib.teams.linux-kernel.members ++ [
+          maintainers.thoughtpolice
+        ];
+        platforms = platforms.linux;
+        timeout = 14400; # 4 hours
+      } // extraMeta;
+    };
 in
 
 assert lib.versionOlder version "5.8" -> libelf != null;
 assert lib.versionAtLeast version "5.8" -> elfutils != null;
 
-stdenv.mkDerivation ({
+stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPatches configfile) // {
   pname = "linux";
-  inherit version src;
+  inherit version;
+
+  enableParallelBuilding = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [
-    bc gmp libmpc mpfr nettools openssl perl python3Minimal rsync ubootTools
-    zstd
-  ] ++ optional  (lib.versionOlder version "5.8") libelf
-    ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-    ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
-    ++ optional  (lib.versionAtLeast version "5.8")  elfutils;
-
-  patches =
-    map (p: p.patch) kernelPatches
-    # Required for deterministic builds along with some postPatch magic.
-    ++ optional (lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
-    ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
-    # Linux 5.12 marked certain PowerPC-only symbols as GPL, which breaks
-    # OpenZFS; this was fixed in Linux 5.19 so we backport the fix
-    # https://github.com/openzfs/zfs/pull/13367
-    ++ optional (lib.versionAtLeast version "5.12" &&
-                 lib.versionOlder version "5.19" &&
-                 stdenv.hostPlatform.isPower)
-      (fetchpatch {
-        url = "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/patch/?id=d9e5c3e9e75162f845880535957b7fd0b4637d23";
-        hash = "sha256-bBOyJcP6jUvozFJU0SPTOf3cmnTQ6ZZ4PlHjiniHXLU=";
-      });
-
-  preUnpack = ''
-    # The same preUnpack is used to build the configfile,
-    # which does not have $dev.
-    if [ -n "$dev" ]; then
-        mkdir -p $dev/lib/modules/${modDirVersion}
-        cd $dev/lib/modules/${modDirVersion}
-    fi
-  '';
-
-  postUnpack = ''
-    mv -Tv "$sourceRoot" source 2>/dev/null || :
-    export sourceRoot=$PWD/source
-  '';
-
-  postPatch = ''
-    sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
-
-    # fixup for pre-4.15 kernels using the $(cd $foo && /bin/pwd) pattern
-    # FIXME: remove when no longer needed
-    substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
-
-    # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
-    # This way kernels can be bit-by-bit reproducible depending on settings
-    # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled).
-    # See also https://kernelnewbies.org/BuildId
-    sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
-
-    # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
-    [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
-
-    # Set randstruct seed to a deterministic but diversified value. Note:
-    # we could have instead patched gen-random-seed.sh to take input from
-    # the buildFlags, but that would require also patching the kernel's
-    # toplevel Makefile to add a variable export. This would be likely to
-    # cause future patch conflicts.
-    for file in scripts/gen-randstruct-seed.sh scripts/gcc-plugins/gen-random-seed.sh; do
-      if [ -f "$file" ]; then
-        substituteInPlace "$file" \
-          --replace NIXOS_RANDSTRUCT_SEED \
-          $(echo ${randstructSeed}${src} ${placeholder "configfile"} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
-        break
-      fi
-    done
-
-    patchShebangs scripts
-
-    # also patch arch-specific install scripts
-    for i in $(find arch -name install.sh); do
-        patchShebangs "$i"
-    done
-  '';
-
-  configurePhase = ''
-    runHook preConfigure
-
-    export buildRoot=$TMPDIR/kernel-buildroot
-    mkdir -p $buildRoot
-
-    echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
-
-    if [ -f "$buildRoot/.config" ]; then
-      echo "Could not link $buildRoot/.config : file exists"
-      exit 1
-    fi
-    ln -sv ${configfile} $buildRoot/.config
-
-    # reads the existing .config file and prompts the user for options in
-    # the current kernel source that are not found in the file.
-    make $makeFlags "''${makeFlagsArray[@]}" oldconfig
-    runHook postConfigure
-
-    make $makeFlags "''${makeFlagsArray[@]}" prepare
-    actualModDirVersion="$(cat $buildRoot/include/config/kernel.release)"
-    if [ "$actualModDirVersion" != "${modDirVersion}" ]; then
-      echo "Error: modDirVersion ${modDirVersion} specified in the Nix expression is wrong, it should be: $actualModDirVersion"
-      exit 1
-    fi
-
-    buildFlagsArray+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
-
-    cd $buildRoot
-  '';
+  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
+      ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
+      ++ optional  (lib.versionOlder version "5.8") libelf
+      ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
+      ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
+      ++ optional  (lib.versionAtLeast version "5.8")  elfutils
+      ;
 
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
 
@@ -219,214 +386,8 @@ stdenv.mkDerivation ({
     "ARCH=${stdenv.hostPlatform.linuxArch}"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
-  ] ++ (kernelConf.makeFlags or [])
+  ] ++ (stdenv.hostPlatform.linux-kernel.makeFlags or [])
     ++ extraMakeFlags;
 
   karch = stdenv.hostPlatform.linuxArch;
-
-  buildFlags = [
-    "DTC_FLAGS=-@"
-    "KBUILD_BUILD_VERSION=1-NixOS"
-
-    # Set by default in the kernel since a73619a845d5,
-    # replicated here to apply to older versions.
-    # Makes __FILE__ relative to the build directory.
-    "KCPPFLAGS=-fmacro-prefix-map=$(sourceRoot)/="
-    kernelConf.target
-  ] ++ optional isModular "modules"
-    ++ optional buildDTBs "dtbs"
-    ++ extraMakeFlags;
-
-  installFlags = [
-    "INSTALL_PATH=$(out)"
-  ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
-  ++ optionals buildDTBs ["dtbs_install" "INSTALL_DTBS_PATH=$(out)/dtbs"];
-
-  preInstall = let
-    # All we really need to do here is copy the final image and System.map to $out,
-    # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
-    # for the rest. Easy, right?
-    #
-    # Unfortunately for us, the obvious way of getting the built image path,
-    # make -s image_name, does not work correctly, because some architectures
-    # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
-    # so we end up attempting to install the thing we didn't actually build.
-    #
-    # Thankfully, there's a way out that doesn't involve just hardcoding everything.
-    #
-    # The kernel has an install target, which runs a pretty simple shell script
-    # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
-    # which kernel version you're looking at) that tries to do something sensible.
-    #
-    # (it would be great to hijack this script immediately, as it has all the
-    #   information we need passed to it and we don't need it to try and be smart,
-    #   but unfortunately, the exact location of the scripts differs between kernel
-    #   versions, and they're seemingly not considered to be public API at all)
-    #
-    # One of the ways it tries to discover what "something sensible" actually is
-    # is by delegating to what's supposed to be a user-provided install script
-    # located at ~/bin/installkernel.
-    #
-    # (the other options are:
-    #   - a distribution-specific script at /sbin/installkernel,
-    #        which we can't really create in the sandbox easily
-    #   - an architecture-specific script at arch/$arch/boot/install.sh,
-    #        which attempts to guess _something_ and usually guesses very wrong)
-    #
-    # More specifically, the install script exec's into ~/bin/installkernel, if one
-    # exists, with the following arguments:
-    #
-    # $1: $KERNELRELEASE - full kernel version string
-    # $2: $KBUILD_IMAGE - the final image path
-    # $3: System.map - path to System.map file, seemingly hardcoded everywhere
-    # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
-    #
-    # $2 is exactly what we want, so hijack the script and use the knowledge given to it
-    # by the makefile overlords for our own nefarious ends.
-    #
-    # Note that the makefiles specifically look in ~/bin/installkernel, and
-    # writeShellScriptBin writes the script to <store path>/bin/installkernel,
-    # so HOME needs to be set to just the store path.
-    #
-    # FIXME: figure out a less roundabout way of doing this.
-    installkernel = buildPackages.writeShellScriptBin "installkernel" ''
-      cp -av $2 $4
-      cp -av $3 $4
-    '';
-  in ''
-    installFlagsArray+=("-j$NIX_BUILD_CORES")
-    export HOME=${installkernel}
-  '';
-
-  # Some image types need special install targets (e.g. uImage is installed with make uinstall)
-  installTargets = [
-    (kernelConf.installTarget or (
-      /**/ if target == "uImage" then "uinstall"
-      else if target == "zImage" || target == "Image.gz" then "zinstall"
-      else "install"))
-  ];
-
-  postInstall = optionalString isModular ''
-    if [ -z "''${dontStrip-}" ]; then
-      installFlagsArray+=("INSTALL_MOD_STRIP=1")
-    fi
-    make modules_install $makeFlags "''${makeFlagsArray[@]}" \
-      $installFlags "''${installFlagsArray[@]}"
-    unlink $out/lib/modules/${modDirVersion}/build
-    unlink $out/lib/modules/${modDirVersion}/source
-
-    mkdir $dev/lib/modules/${modDirVersion}/build
-
-    cd $dev/lib/modules/${modDirVersion}/source
-
-    cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
-    make modules_prepare $makeFlags "''${makeFlagsArray[@]}" O=$dev/lib/modules/${modDirVersion}/build
-
-    # For reproducibility, removes accidental leftovers from a `cc1` call
-    # from a `try-run` call from the Makefile
-    rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
-
-    # Keep some extra files
-    for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o \
-             scripts/gdb/linux vmlinux vmlinux-gdb.py
-    do
-      if [ -e "$buildRoot/$f" ]; then
-        mkdir -p "$(dirname "$dev/lib/modules/${modDirVersion}/build/$f")"
-        cp -HR $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
-      fi
-    done
-    ln -s $dev/lib/modules/${modDirVersion}/build/vmlinux $dev
-
-    # !!! No documentation on how much of the source tree must be kept
-    # If/when kernel builds fail due to missing files, you can add
-    # them here. Note that we may see packages requiring headers
-    # from drivers/ in the future; it adds 50M to keep all of its
-    # headers on 3.10 though.
-
-    chmod u+w -R ..
-    arch=$(cd $dev/lib/modules/${modDirVersion}/build/arch; ls)
-
-    # Remove unused arches
-    for d in $(cd arch/; ls); do
-      if [ "$d" = "$arch" ]; then continue; fi
-      if [ "$arch" = arm64 ] && [ "$d" = arm ]; then continue; fi
-      rm -rf arch/$d
-    done
-
-    # Remove all driver-specific code (50M of which is headers)
-    rm -fR drivers
-
-    # Keep all headers
-    find .  -type f -name '*.h' -print0 | xargs -0 -r chmod u-w
-
-    # Keep linker scripts (they are required for out-of-tree modules on aarch64)
-    find .  -type f -name '*.lds' -print0 | xargs -0 -r chmod u-w
-
-    # Keep root and arch-specific Makefiles
-    chmod u-w Makefile arch/"$arch"/Makefile*
-
-    # Keep whole scripts dir
-    chmod u-w -R scripts
-
-    # Delete everything not kept
-    find . -type f -perm -u=w -print0 | xargs -0 -r rm
-
-    # Delete empty directories
-    find -empty -type d -delete
-
-    # Remove reference to kmod
-    sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
-  ''
-  # unfortunately linux/arch/mips/Makefile does not understand installkernel
-  # and simply copies to $(INSTALL_PATH)/vmlinux-$(KERNELRELEASE)
-  + lib.optionalString stdenv.hostPlatform.isMips ''
-    mv $out/vmlinux-* $out/vmlinux || true
-    mv $out/vmlinuz-* $out/vmlinuz || true
-    mv $out/System.map-* $out/System.map
-  '';
-
-  preFixup = ''
-    # Don't strip $dev/lib/modules/*/vmlinux
-    stripDebugList="$(cd $dev && echo lib/modules/*/build/*/)"
-  '' + lib.optionalString (stdenv.hostPlatform.isMips) ''
-    $STRIP -s $out/vmlinux || true
-  '';
-
-  enableParallelBuilding = true;
-
-  passthru = rec {
-    inherit version modDirVersion config kernelPatches configfile
-      moduleBuildDependencies stdenv;
-    inherit isZen isHardened isLibre;
-    isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
-    baseVersion = lib.head (lib.splitString "-rc" version);
-    kernelOlder = lib.versionOlder baseVersion;
-    kernelAtLeast = lib.versionAtLeast baseVersion;
-  };
-
-  requiredSystemFeatures = [ "big-parallel" ];
-
-  meta = {
-    description =
-      "The Linux kernel" +
-      (lib.optionalString (kernelPatches != []) (
-        " (with patches: "
-        + lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
-        + ")"
-      ));
-    license = lib.licenses.gpl2Only;
-    homepage = "https://www.kernel.org/";
-    maintainers = lib.teams.linux-kernel.members ++ [
-      maintainers.thoughtpolice
-    ];
-    platforms = platforms.linux;
-    badPlatforms =
-      lib.optionals (lib.versionOlder version "4.15") [ "riscv32-linux" "riscv64-linux" ] ++
-      lib.optional (lib.versionOlder version "5.19") "loongarch64-linux";
-    timeout = 14400; # 4 hours
-  } // extraMeta;
-} // optionalAttrs (pos != null) {
-  inherit pos;
-} // optionalAttrs isModular {
-  outputs = [ "out" "dev" ];
-}))
+} // (optionalAttrs (pos != null) { inherit pos; })))
diff --git a/pkgs/servers/baserow/default.nix b/pkgs/servers/baserow/default.nix
index 09a1b5e83da2e..34fba145c9c4b 100644
--- a/pkgs/servers/baserow/default.nix
+++ b/pkgs/servers/baserow/default.nix
@@ -29,6 +29,8 @@ let
 
         doCheck = false;
       };
+
+      django = super.django_3;
     };
   };
 in
diff --git a/pkgs/servers/mail/mailman/python.nix b/pkgs/servers/mail/mailman/python.nix
index cd18fa161fac7..8549cb7150d2a 100644
--- a/pkgs/servers/mail/mailman/python.nix
+++ b/pkgs/servers/mail/mailman/python.nix
@@ -12,12 +12,14 @@ python3.override {
         to arise again. Since we don't want to clutter the python package-set
         itself with version overrides and don't want to change the APIs
         in here back and forth every time this comes up (and as a result
-        force users to change their code accordingly), this empty overlay
-        is kept on purpose.
+        force users to change their code accordingly), this overlay
+        is kept on purpose, even when empty.
 
         [1] 72a14ea563a3f5bf85db659349a533fe75a8b0ce
         [2] f931bc81d63f5cfda55ac73d754c87b3fd63b291
       */
+      django = super.django_3;
     })
+
     overlay;
 }
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 2cef090aaa9f5..0074c6fd6f0ad 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -311,46 +311,48 @@ let
   };
 
   mkPackages = self: {
+    # TODO: remove ahead of 23.11 branchoff
+    # "PostgreSQL 11 will stop receiving fixes on November 9, 2023"
     postgresql_11 = self.callPackage generic {
-      version = "11.20";
+      version = "11.21";
       psqlSchema = "11.1"; # should be 11, but changing it is invasive
-      hash = "sha256-PXyIgvZKfphTSgRCV9/uerrXelt9oSUI2F1yK5i1rM4=";
+      hash = "sha256-B7CDdHHV3XeyUWazRxjzuhCBa2rWHmkeb8VHzz/P+FA=";
       this = self.postgresql_11;
       thisAttr = "postgresql_11";
       inherit self;
     };
 
     postgresql_12 = self.callPackage generic {
-      version = "12.15";
+      version = "12.16";
       psqlSchema = "12";
-      hash = "sha256-u1IG4oZMHEV5k4uW6mCW0VXyKr8tLMKqV1cePEyxKzY=";
+      hash = "sha256-xfH/96D5Ph7DdGQXsFlCkOzmF7SZXtlbjVJ68LoOOPM=";
       this = self.postgresql_12;
       thisAttr = "postgresql_12";
       inherit self;
     };
 
     postgresql_13 = self.callPackage generic {
-      version = "13.11";
+      version = "13.12";
       psqlSchema = "13";
-      hash = "sha256-SZL/ZHIDVmtnDU5U3FMXSZomhWyTV20OqVG99r7lC/s=";
+      hash = "sha256-DaHtzuNRS3vHum268MAEmeisFZBmjoeJxQJTpiSfIYs=";
       this = self.postgresql_13;
       thisAttr = "postgresql_13";
       inherit self;
     };
 
     postgresql_14 = self.callPackage generic {
-      version = "14.8";
+      version = "14.9";
       psqlSchema = "14";
-      hash = "sha256-OdOPADBzftA4Nd6+7+47N9M1RizkmV4kl7w41iHr5Fo=";
+      hash = "sha256-sf47qbGn86ljfdFlbf2tKIkBYHP9TTXxO1AUPLu2qO8=";
       this = self.postgresql_14;
       thisAttr = "postgresql_14";
       inherit self;
     };
 
     postgresql_15 = self.callPackage generic {
-      version = "15.3";
+      version = "15.4";
       psqlSchema = "15";
-      hash = "sha256-/8fUiR8A/79cP06rf7vO2EYLjA7mPFpRZxM7nmWZ2TI=";
+      hash = "sha256-uuxaS9xENzNmU7bLXZ7Ym+W9XAxYuU4L7O4KmZ5jyPk=";
       this = self.postgresql_15;
       thisAttr = "postgresql_15";
       inherit self;
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 00b4a707ed08c..6b126390c9f6e 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -61,6 +61,10 @@ stdenv.mkDerivation rec {
       url = "https://cgit.freebsd.org/ports/plain/shells/bash/files/patch-configure?id=3e147a1f594751a68fea00a28090d0792bee0b51";
       sha256 = "XHFMQ6eXTReNoywdETyrfQEv1rKF8+XFbQZP4YoVKFk=";
     })
+    # Apply parallel build fix pending upstream inclusion:
+    #   https://savannah.gnu.org/patch/index.php?10373
+    # Had to fetch manually to workaround -p0 default.
+    ./parallel.patch
   ];
 
   configureFlags = [
diff --git a/pkgs/shells/bash/parallel.patch b/pkgs/shells/bash/parallel.patch
new file mode 100644
index 0000000000000..d9a0cc28ce045
--- /dev/null
+++ b/pkgs/shells/bash/parallel.patch
@@ -0,0 +1,12 @@
+From https://savannah.gnu.org/patch/index.php?10373
+  https://savannah.gnu.org/patch/download.php?file_id=54964
+--- Makefile.in
++++ Makefile.in
+@@ -1432,6 +1432,7 @@ siglist.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ subst.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ test.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ trap.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
++unwind_prot.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ variables.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ version.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
+ xmalloc.o: bashintl.h ${LIBINTL_H} $(BASHINCDIR)/gettext.h
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 7e6a707776305..25a80fd11aa2d 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -65,11 +65,7 @@ let
   isBuiltByBootstrapFilesCompiler =
     pkg: isFromNixpkgs pkg && isFromBootstrapFiles pkg.stdenv.cc.cc;
 
-  commonPreHook = pkgs: lib.optionalString (pkgs.darwin.system_cmds != null) ''
-    # Only use a response file on older systems with a small ARG_MAX (less than 1 MiB).
-    export NIX_CC_USE_RESPONSE_FILE=$(( "$("${lib.getBin pkgs.darwin.system_cmds}/bin/getconf" ARG_MAX)" < 1048576 ))
-    export NIX_LD_USE_RESPONSE_FILE=$NIX_CC_USE_RESPONSE_FILE
-  '' + ''
+  commonPreHook = ''
     export NIX_ENFORCE_NO_NATIVE=''${NIX_ENFORCE_NO_NATIVE-1}
     export NIX_ENFORCE_PURITY=''${NIX_ENFORCE_PURITY-1}
     export NIX_IGNORE_LD_THROUGH_GCC=1
@@ -166,7 +162,7 @@ let
           # dependencies on the bootstrapTools in the final stdenv.
           dontPatchShebangs=1
         '' + ''
-          ${commonPreHook prevStage}
+          ${commonPreHook}
           ${extraPreHook}
         '' + lib.optionalString (prevStage.darwin ? locale) ''
           export PATH_LOCALE=${prevStage.darwin.locale}/share/locale
@@ -216,7 +212,6 @@ in
       print-reexports = null;
       rewrite-tbd = null;
       sigtool = null;
-      system_cmds = null;
       CF = null;
       Libsystem = null;
     };
@@ -300,27 +295,6 @@ in
         rewrite-tbd = bootstrapTools;
 
         sigtool = bootstrapTools;
-
-        # The bootstrap only needs `getconf` from system_cmds, and it only needs to be able to
-        # query `ARG_MAX`. Using a small value here should be fine for the initial stage 1 build.
-        system_cmds = self.stdenv.mkDerivation {
-          name = "bootstrap-stage0-system_cmds";
-          buildCommand = ''
-            mkdir -p "$out/bin"
-            cat <<block > "$out/bin/getconf"
-            #!${bootstrapTools}/bin/bash
-            case "\$1" in
-              ARG_MAX)
-                echo "262144"
-                ;;
-              *)
-                exit 1
-            esac
-            block
-            chmod a+x "$out/bin/getconf"
-          '';
-          passthru.isFromBootstrapFiles = true;
-        };
       } // lib.optionalAttrs (! useAppleSDKLibs) {
         CF = self.stdenv.mkDerivation {
           name = "bootstrap-stage0-CF";
@@ -453,7 +427,7 @@ in
     assert lib.all isFromBootstrapFiles (with prevStage; [ bash coreutils cpio gnugrep pbzx ]);
 
     assert lib.all isFromBootstrapFiles (with prevStage.darwin; [
-      binutils-unwrapped cctools print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isFromBootstrapFiles (with prevStage.darwin; [ CF Libsystem ]);
@@ -486,12 +460,14 @@ in
       python3 = super.python3Minimal;
 
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
-        inherit (prevStage.darwin) system_cmds;
-
         signingUtils = prevStage.darwin.signingUtils.override {
           inherit (selfDarwin) sigtool;
         };
 
+        postLinkSignHook = prevStage.darwin.postLinkSignHook.override {
+          inherit (selfDarwin) sigtool;
+        };
+
         binutils = superDarwin.binutils.override {
           inherit (self) coreutils;
           inherit (selfDarwin) postLinkSignHook signingUtils;
@@ -536,7 +512,7 @@ in
     '';
   })
 
-  # Build sysctl, system_cmds and Python for use by LLVM’s check phase. These must be built in their
+  # Build sysctl and Python for use by LLVM’s check phase. These must be built in their
   # own stage, or an infinite recursion results on x86_64-darwin when using the source-based SDK.
   (prevStage:
     # previous stage1 stdenv:
@@ -553,8 +529,6 @@ in
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
       binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
-    assert lib.all isFromBootstrapFiles (with prevStage.darwin; [ system_cmds ]);
-
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
     assert    useAppleSDKLibs  -> lib.all                   isFromNixpkgs (with prevStage.darwin; [ CF Libsystem libobjc]);
     assert lib.all isFromNixpkgs (with prevStage.darwin; [ dyld launchd xnu ]);
@@ -651,7 +625,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
@@ -679,8 +653,7 @@ in
       darwin = super.darwin.overrideScope (_: superDarwin: {
         inherit (prevStage.darwin)
           CF Libsystem configd darwin-stubs dyld launchd libclosure libdispatch libobjc
-          locale objc4 postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool
-          system_cmds;
+          locale objc4 postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool;
 
         # Avoid building unnecessary Python dependencies due to building LLVM manpages.
         cctools-llvm = superDarwin.cctools-llvm.override { enableManpages = false; };
@@ -749,7 +722,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
@@ -786,7 +759,7 @@ in
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         inherit (prevStage.darwin)
           CF binutils-unwrapped cctools configd darwin-stubs launchd libobjc libtapi locale
-          objc4 print-reexports rewrite-tbd signingUtils sigtool system_cmds;
+          objc4 print-reexports rewrite-tbd signingUtils sigtool;
       });
 
       llvmPackages = super.llvmPackages // (
@@ -848,7 +821,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools locale libtapi print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [ CF configd ]);
@@ -882,7 +855,7 @@ in
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         inherit (prevStage.darwin)
           Libsystem configd darwin-stubs launchd locale print-reexports rewrite-tbd
-          signingUtils sigtool system_cmds;
+          signingUtils sigtool;
 
         # Rewrap binutils so it uses the rebuilt Libsystem.
         binutils = superDarwin.binutils.override {
@@ -971,7 +944,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      locale print-reexports rewrite-tbd sigtool system_cmds
+      locale print-reexports rewrite-tbd sigtool
     ]);
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
       binutils-unwrapped cctools libtapi
@@ -1011,7 +984,7 @@ in
         inherit (prevStage.darwin)
           CF Libsystem binutils binutils-unwrapped cctools cctools-llvm cctools-port configd
           darwin-stubs dyld launchd libclosure libdispatch libobjc libtapi locale objc4
-          postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool system_cmds;
+          postLinkSignHook print-reexports rewrite-tbd signingUtils sigtool;
       });
 
       llvmPackages = super.llvmPackages // (
@@ -1051,7 +1024,7 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage.darwin; [
-      locale print-reexports rewrite-tbd sigtool system_cmds
+      locale print-reexports rewrite-tbd sigtool
     ]);
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
       binutils-unwrapped cctools libtapi
@@ -1191,7 +1164,7 @@ in
     ]);
 
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
-      binutils-unwrapped cctools libtapi locale print-reexports rewrite-tbd sigtool system_cmds
+      binutils-unwrapped cctools libtapi locale print-reexports rewrite-tbd sigtool
     ]);
 
     assert (! useAppleSDKLibs) -> lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [ CF Libsystem configd ]);
@@ -1226,7 +1199,8 @@ in
 
       inherit config;
 
-      preHook = (commonPreHook prevStage) + ''
+      preHook = ''
+        ${commonPreHook}
         stripDebugFlags="-S" # llvm-strip does not support "-p" for Mach-O
         export PATH_LOCALE=${prevStage.darwin.locale}/share/locale
       '';
@@ -1324,7 +1298,6 @@ in
         dyld
         libtapi
         locale
-        system_cmds
       ]
       ++ lib.optional useAppleSDKLibs [ objc4 ]
       ++ lib.optionals doSign [ postLinkSignHook sigtool signingUtils ]);
@@ -1341,7 +1314,7 @@ in
 
         darwin = super.darwin.overrideScope (_: _: {
           inherit (prevStage.darwin)
-            CF ICU Libsystem darwin-stubs dyld locale libobjc libtapi system_cmds xnu;
+            CF ICU Libsystem darwin-stubs dyld locale libobjc libtapi xnu;
         } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
           inherit (prevStage.darwin) binutils binutils-unwrapped cctools-llvm cctools-port;
         });
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 0d9ae8d3c4fb9..cf194be92bd75 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -70,10 +70,7 @@ let
       ../../build-support/setup-hooks/prune-libtool-files.sh
       ../../build-support/setup-hooks/reproducible-builds.sh
       ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
-      (with buildPlatform; if isAarch64 && isLinux
-        then ../../build-support/setup-hooks/strip-tmp-aarch64.sh
-        else ../../build-support/setup-hooks/strip.sh
-      )
+      ../../build-support/setup-hooks/strip.sh
     ] ++ lib.optionals hasCC [ cc ];
 
   defaultBuildInputs = extraBuildInputs;
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 0e483321b9357..34fffd36aa6ab 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -194,6 +194,7 @@ let
           inherit lib;
           inherit (prevStage) coreutils gnugrep;
           stdenvNoCC = prevStage.ccWrapperStdenv;
+          fortify-headers = prevStage.fortify-headers;
         }).overrideAttrs(a: lib.optionalAttrs (prevStage.gcc-unwrapped.passthru.isXgcc or false) {
           # This affects only `xgcc` (the compiler which compiles the final compiler).
           postFixup = (a.postFixup or "") + ''
@@ -568,6 +569,7 @@ in
         inherit lib;
         inherit (self) stdenvNoCC coreutils gnugrep;
         shell = self.bash + "/bin/bash";
+        fortify-headers = self.fortify-headers;
       };
     };
     extraNativeBuildInputs = [
@@ -645,6 +647,7 @@ in
         ++  [ linuxHeaders # propagated from .dev
             binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params gcc.cc.libgcc glibc.passthru.libgcc
           ]
+        ++ lib.optionals (localSystem.libc == "musl") [ fortify-headers ]
         ++ [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ]
         ++ (with gcc-unwrapped.passthru; [
           gmp libmpc mpfr isl
diff --git a/pkgs/test/stdenv/patch-shebangs.nix b/pkgs/test/stdenv/patch-shebangs.nix
index fb52f38ecc91b..888d4a53a2733 100644
--- a/pkgs/test/stdenv/patch-shebangs.nix
+++ b/pkgs/test/stdenv/patch-shebangs.nix
@@ -39,6 +39,23 @@ let
       };
     };
 
+    updates-nix-store = stdenv.mkDerivation {
+      name = "updates-nix-store";
+      strictDeps = false;
+      dontUnpack = true;
+      installPhase = ''
+        mkdir -p $out/bin
+        echo "#!$NIX_STORE/path/to/bash" > $out/bin/test
+        echo "echo -n hello" >> $out/bin/test
+        chmod +x $out/bin/test
+        patchShebangs --update $out/bin/test
+        dontPatchShebangs=1
+      '';
+      passthru = {
+        assertion = "grep '^#!${stdenv.shell}' $out/bin/test > /dev/null";
+      };
+    };
+
     split-string = stdenv.mkDerivation {
       name = "split-string";
       strictDeps = false;
@@ -59,7 +76,7 @@ let
 in
 stdenv.mkDerivation {
   name = "test-patch-shebangs";
-  passthru = { inherit (tests) bad-shebang ignores-nix-store split-string; };
+  passthru = { inherit (tests) bad-shebang ignores-nix-store updates-nix-store split-string; };
   buildCommand = ''
     validate() {
       local name=$1
diff --git a/pkgs/tools/archivers/zip/default.nix b/pkgs/tools/archivers/zip/default.nix
index ee5357f79558e..1ac615a3d90ff 100644
--- a/pkgs/tools/archivers/zip/default.nix
+++ b/pkgs/tools/archivers/zip/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     ];
     sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h";
   };
-  patchPhase = ''
+  prePatch = ''
     substituteInPlace unix/Makefile --replace 'CC = cc' ""
   '';
 
@@ -26,7 +26,14 @@ stdenv.mkDerivation rec {
     "INSTALL=cp"
   ];
 
-  patches = lib.optionals (enableNLS && !stdenv.isCygwin) [ ./natspec-gentoo.patch.bz2 ];
+  patches = [
+    # Trying to use `memset` without declaring it is flagged as an error with clang 16, causing
+    # the `configure` script to incorrectly define `ZMEM`. That causes the build to fail due to
+    # incompatible redeclarations of `memset`, `memcpy`, and `memcmp` in `zip.h`.
+    ./fix-memset-detection.patch
+    # Implicit declaration of `closedir` and `opendir` cause dirent detection to fail with clang 16.
+    ./fix-implicit-declarations.patch
+  ] ++ lib.optionals (enableNLS && !stdenv.isCygwin) [ ./natspec-gentoo.patch.bz2 ];
 
   buildInputs = lib.optional enableNLS libnatspec
     ++ lib.optional stdenv.isCygwin libiconv;
diff --git a/pkgs/tools/archivers/zip/fix-implicit-declarations.patch b/pkgs/tools/archivers/zip/fix-implicit-declarations.patch
new file mode 100644
index 0000000000000..df19bf1722f93
--- /dev/null
+++ b/pkgs/tools/archivers/zip/fix-implicit-declarations.patch
@@ -0,0 +1,21 @@
+--- a/unix/configure	2009-04-16 15:25:12.000000000 -0400
++++ b/unix/configure	2023-05-30 15:18:33.670321348 -0400
+@@ -408,7 +408,7 @@
+ echo Check for errno declaration
+ cat > conftest.c << _EOF_
+ #include <errno.h>
+-main()
++int main()
+ {
+   errno = 0;
+   return 0;
+@@ -419,6 +419,8 @@
+ 
+ echo Check for directory libraries
+ cat > conftest.c << _EOF_
++#include <sys/types.h>
++#include <dirent.h>
+ int main() { return closedir(opendir(".")); }
+ _EOF_
+ 
+
diff --git a/pkgs/tools/archivers/zip/fix-memset-detection.patch b/pkgs/tools/archivers/zip/fix-memset-detection.patch
new file mode 100644
index 0000000000000..55bda33a25730
--- /dev/null
+++ b/pkgs/tools/archivers/zip/fix-memset-detection.patch
@@ -0,0 +1,15 @@
+diff -ur a/unix/configure b/unix/configure
+--- a/unix/configure	2008-06-19 21:32:20.000000000 -0600
++++ b/unix/configure	2023-07-11 10:02:57.809867694 -0600
+@@ -519,7 +519,10 @@
+ 
+ 
+ echo Check for memset
+-echo "int main(){ char k; memset(&k,0,0); return 0; }" > conftest.c
++cat > conftest.c << _EOF_
++#include <string.h>
++int main(){ char k; memset(&k,0,0); return 0; }
++_EOF_
+ $CC -o conftest conftest.c >/dev/null 2>/dev/null
+ [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DZMEM"
+ 
diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index 44bee00d0842f..adc73d926c905 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xz";
-  version = "5.4.3";
+  version = "5.4.4";
 
   src = fetchurl {
     url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "sha256-kkOgRZjXpwwfVnoBQ6JVWBrFxksUD9Vf1cvB4AsOb5A=";
+    sha256 = "sha256-C2/N4aw46QQzolVvUAwGWVC5vNLWAgBu/DNHgr3+YpY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index 1b7fd162dba5f..71892916ad7a6 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "graphviz";
-  version = "8.0.5";
+  version = "8.1.0";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     rev = version;
-    hash = "sha256-s3AUOLZhehxs2GcDCsq87RVvsDli1NvvQtwI0AyUs4k=";
+    hash = "sha256-xTdrtwSpizqf5tNRX0Q0w10mEk4S0X7cmxHj3Us14kY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/android-tools/default.nix b/pkgs/tools/misc/android-tools/default.nix
index 6436e692ae441..6276d50c73d42 100644
--- a/pkgs/tools/misc/android-tools/default.nix
+++ b/pkgs/tools/misc/android-tools/default.nix
@@ -16,6 +16,19 @@ stdenv.mkDerivation rec {
     hash = "sha256-YCNOy8oZoXp+L0akWBlg1kW3xVuHDZJKIUlMdqb1SOw=";
   };
 
+  patches = [
+    # Fix building with newer protobuf versions.
+    (fetchurl {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/android-tools/-/raw/295ad7d5cb1e3b4c75bd40281d827f9168bbaa57/protobuf-23.patch";
+      hash = "sha256-KznGgZdYT6e5wG3gtfJ6i93bYfp/JFygLW/ZzvXUA0Y=";
+    })
+  ];
+
+  # Fix linking with private abseil-cpp libraries.
+  postPatch = ''
+    sed -i '/^find_package(Protobuf REQUIRED)$/i find_package(protobuf CONFIG)' vendor/CMakeLists.txt
+  '';
+
   nativeBuildInputs = [ cmake pkg-config perl go ];
   buildInputs = [ protobuf zlib gtest brotli lz4 zstd libusb1 pcre2 ];
   propagatedBuildInputs = [ pythonEnv ];
diff --git a/pkgs/tools/misc/nanoemoji/default.nix b/pkgs/tools/misc/nanoemoji/default.nix
index 93817ff847987..401783bcc4a1a 100644
--- a/pkgs/tools/misc/nanoemoji/default.nix
+++ b/pkgs/tools/misc/nanoemoji/default.nix
@@ -36,7 +36,7 @@ python3.pkgs.buildPythonApplication rec {
     absl-py
     fonttools
     lxml
-    ninja-python
+    ninja
     picosvg
     pillow
     regex
@@ -50,7 +50,7 @@ python3.pkgs.buildPythonApplication rec {
   nativeCheckInputs = with python3.pkgs; [
     pytestCheckHook
 
-    ninja-python
+    ninja
     picosvg
   ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c89e688e2db64..5e7ed40e0bea1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -731,7 +731,9 @@ with pkgs;
 
   protoc-gen-go-vtproto = callPackage ../development/tools/protoc-gen-go-vtproto { };
 
-  protoc-gen-grpc-web = callPackage ../development/tools/protoc-gen-grpc-web { };
+  protoc-gen-grpc-web = callPackage ../development/tools/protoc-gen-grpc-web {
+    protobuf = protobuf3_21;
+  };
 
   protoc-gen-connect-go = callPackage ../development/tools/protoc-gen-connect-go { };
 
@@ -2570,7 +2572,9 @@ with pkgs;
 
   gensgs = pkgsi686Linux.callPackage ../applications/emulators/gens-gs { };
 
-  goldberg-emu = callPackage ../applications/emulators/goldberg-emu { };
+  goldberg-emu = callPackage ../applications/emulators/goldberg-emu {
+    protobuf = protobuf3_21;
+  };
 
   gopsuinfo = callPackage ../tools/system/gopsuinfo { };
 
@@ -4063,7 +4067,9 @@ with pkgs;
 
   amoco = callPackage ../tools/security/amoco { };
 
-  anbox = callPackage ../os-specific/linux/anbox { };
+  anbox = callPackage ../os-specific/linux/anbox {
+    protobuf = protobuf3_21;
+  };
 
   androidenv = callPackage ../development/mobile/androidenv { };
 
@@ -4617,7 +4623,9 @@ with pkgs;
 
   common-licenses = callPackage ../data/misc/common-licenses { };
 
-  compactor = callPackage ../applications/networking/compactor { };
+  compactor = callPackage ../applications/networking/compactor {
+    protobuf = protobuf3_21;
+  };
 
   consul = callPackage ../servers/consul { };
 
@@ -5425,8 +5433,9 @@ with pkgs;
 
   ghdorker = callPackage ../tools/security/ghdorker { };
 
-  ghidra = if stdenv.isDarwin then darwin.apple_sdk_11_0.callPackage ../tools/security/ghidra/build.nix {}
-  else callPackage ../tools/security/ghidra/build.nix { };
+  ghidra = darwin.apple_sdk_11_0.callPackage ../tools/security/ghidra/build.nix {
+    protobuf = protobuf3_21;
+  };
 
   ghidra-bin = callPackage ../tools/security/ghidra { };
 
@@ -6713,6 +6722,7 @@ with pkgs;
   clementine = libsForQt5.callPackage ../applications/audio/clementine {
     gst_plugins =
       with gst_all_1; [ gst-plugins-base gst-plugins-good gst-plugins-ugly gst-libav ];
+    protobuf = protobuf3_21;
   };
 
   mellowplayer = libsForQt5.callPackage ../applications/audio/mellowplayer { };
@@ -6894,7 +6904,7 @@ with pkgs;
 
     mozc = callPackage ../tools/inputmethods/ibus-engines/ibus-mozc {
       stdenv = clangStdenv;
-      protobuf = pkgs.protobuf.overrideDerivation (_: { stdenv = clangStdenv; });
+      protobuf = pkgs.protobuf3_21.overrideDerivation (_: { stdenv = clangStdenv; });
     };
 
     rime = callPackage ../tools/inputmethods/ibus-engines/ibus-rime { };
@@ -10061,6 +10071,7 @@ with pkgs;
 
   netdata = callPackage ../tools/system/netdata {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation IOKit;
+    protobuf = protobuf3_21;
   };
   # Exposed here so the bots can auto-upgrade it
   netdata-go-plugins = callPackage ../tools/system/netdata/go.d.plugin.nix { };
@@ -10759,7 +10770,9 @@ with pkgs;
     electron = electron_22;
   };
 
-  mosh = callPackage ../tools/networking/mosh { };
+  mosh = callPackage ../tools/networking/mosh {
+    protobuf = protobuf3_21;
+  };
 
   motrix = callPackage ../tools/networking/motrix { };
 
@@ -11204,7 +11217,9 @@ with pkgs;
 
   nq = callPackage ../tools/system/nq { };
 
-  nsjail = callPackage ../tools/security/nsjail { };
+  nsjail = callPackage ../tools/security/nsjail {
+    protobuf = protobuf3_21;
+  };
 
   nss_pam_ldapd = callPackage ../tools/networking/nss-pam-ldapd { };
 
@@ -11336,7 +11351,9 @@ with pkgs;
 
   oh-my-zsh = callPackage ../shells/zsh/oh-my-zsh { };
 
-  ola = callPackage ../applications/misc/ola { };
+  ola = callPackage ../applications/misc/ola {
+    protobuf = protobuf3_21;
+  };
 
   olive-editor = qt6Packages.callPackage ../applications/video/olive-editor {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation;
@@ -11607,7 +11624,9 @@ with pkgs;
 
   p3x-onenote = callPackage ../applications/office/p3x-onenote { };
 
-  p4c = callPackage ../development/compilers/p4c { };
+  p4c = callPackage ../development/compilers/p4c {
+    protobuf = protobuf3_21;
+  };
 
   p7zip = callPackage ../tools/archivers/p7zip { };
 
@@ -14974,7 +14993,9 @@ with pkgs;
 
   zasm = callPackage ../development/compilers/zasm { };
 
-  zbackup = callPackage ../tools/backup/zbackup { };
+  zbackup = callPackage ../tools/backup/zbackup {
+    protobuf = protobuf3_21;
+  };
 
   zbar = libsForQt5.callPackage ../tools/graphics/zbar {
     inherit (darwin.apple_sdk.frameworks) Foundation;
@@ -20076,9 +20097,14 @@ with pkgs;
     flex = flex_2_5_35;
   };
 
-  spoofer = callPackage ../tools/networking/spoofer { };
+  spoofer = callPackage ../tools/networking/spoofer {
+    protobuf = protobuf3_21;
+  };
 
-  spoofer-gui = callPackage ../tools/networking/spoofer { withGUI = true; };
+  spoofer-gui = callPackage ../tools/networking/spoofer {
+    withGUI = true;
+    protobuf = protobuf3_21;
+  };
 
   spooles = callPackage ../development/libraries/science/math/spooles { };
 
@@ -20798,7 +20824,9 @@ with pkgs;
 
   cmrt = callPackage ../development/libraries/cmrt { };
 
-  codecserver = callPackage ../applications/audio/codecserver { };
+  codecserver = callPackage ../applications/audio/codecserver {
+    protobuf = protobuf3_21;
+  };
 
   coeurl = callPackage ../development/libraries/coeurl { };
 
@@ -21264,6 +21292,8 @@ with pkgs;
 
   folks = callPackage ../development/libraries/folks { };
 
+  fortify-headers = callPackage ../development/libraries/fortify-headers { };
+
   makeFontsConf = let fontconfig_ = fontconfig; in {fontconfig ? fontconfig_, fontDirectories}:
     callPackage ../development/libraries/fontconfig/make-fonts-conf.nix {
       inherit fontconfig fontDirectories;
@@ -21304,7 +21334,9 @@ with pkgs;
 
   gallia = callPackage ../tools/security/gallia { };
 
-  gamenetworkingsockets = callPackage ../development/libraries/gamenetworkingsockets { };
+  gamenetworkingsockets = callPackage ../development/libraries/gamenetworkingsockets {
+    protobuf = protobuf3_21;
+  };
 
   game-music-emu = callPackage ../development/libraries/audio/game-music-emu { };
 
@@ -21680,12 +21712,7 @@ with pkgs;
 
   grilo-plugins = callPackage ../development/libraries/grilo-plugins { };
 
-  grpc = callPackage ../development/libraries/grpc {
-    # grpc builds with c++17 so abseil must also be built that way
-    abseil-cpp = abseil-cpp_202206.override {
-      cxxStandard = grpc.cxxStandard;
-    };
-  };
+  grpc = callPackage ../development/libraries/grpc { };
 
   gsettings-qt = libsForQt5.callPackage ../development/libraries/gsettings-qt { };
 
@@ -23322,7 +23349,9 @@ with pkgs;
 
   libptytty = callPackage ../development/libraries/libptytty { };
 
-  libpulsar = callPackage ../development/libraries/libpulsar { };
+  libpulsar = callPackage ../development/libraries/libpulsar {
+    protobuf = protobuf3_21;
+  };
 
   libpwquality = callPackage ../development/libraries/libpwquality {
     python = python3;
@@ -23727,7 +23756,9 @@ with pkgs;
 
   lightspark = callPackage ../misc/lightspark { };
 
-  lightstep-tracer-cpp = callPackage ../development/libraries/lightstep-tracer-cpp { };
+  lightstep-tracer-cpp = callPackage ../development/libraries/lightstep-tracer-cpp {
+    protobuf = protobuf3_21;
+  };
 
   ligolo-ng = callPackage ../tools/networking/ligolo-ng { };
 
@@ -24476,8 +24507,9 @@ with pkgs;
 
   prospector = callPackage ../development/tools/prospector { };
 
-  protobuf = protobuf3_21;
+  protobuf = protobuf3_23;
 
+  protobuf3_23 = callPackage ../development/libraries/protobuf/3.23.nix { };
   protobuf3_21 = callPackage ../development/libraries/protobuf/3.21.nix {
     abseil-cpp = abseil-cpp_202103;
   };
@@ -24686,7 +24718,9 @@ with pkgs;
 
   qm-dsp = callPackage ../development/libraries/audio/qm-dsp { };
 
-  qradiolink = callPackage ../applications/radio/qradiolink { };
+  qradiolink = callPackage ../applications/radio/qradiolink {
+    protobuf = protobuf3_21;
+  };
 
   qrupdate = callPackage ../development/libraries/qrupdate { };
 
@@ -25832,6 +25866,17 @@ with pkgs;
     go = buildPackages.go_1_20;
   };
 
+  # requires a newer Apple SDK
+  go_1_21 = darwin.apple_sdk_11_0.callPackage ../development/compilers/go/1.21.nix {
+    inherit (darwin.apple_sdk_11_0.frameworks) Foundation Security;
+  };
+  buildGo121Module = darwin.apple_sdk_11_0.callPackage ../build-support/go/module.nix {
+    go = buildPackages.go_1_21;
+  };
+  buildGo121Package = darwin.apple_sdk_11_0.callPackage ../build-support/go/package.nix {
+    go = buildPackages.go_1_21;
+  };
+
   go2nix = callPackage ../development/tools/go2nix { };
 
   leaps = callPackage ../development/tools/leaps { };
@@ -26892,6 +26937,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
     boost = boost177; # Configure checks for specific version.
     icu = icu69;
+    protobuf = protobuf3_21;
   };
 
   mysql_jdbc = callPackage ../servers/sql/mysql/jdbc { };
@@ -27171,6 +27217,7 @@ with pkgs;
   rethinkdb = callPackage ../servers/nosql/rethinkdb {
     stdenv = clangStdenv;
     libtool = darwin.cctools;
+    protobuf = protobuf3_21;
   };
 
   rippled = callPackage ../servers/rippled {
@@ -28612,7 +28659,9 @@ with pkgs;
 
   sgx-ssl = callPackage ../os-specific/linux/sgx/ssl { };
 
-  sgx-psw = callPackage ../os-specific/linux/sgx/psw { };
+  sgx-psw = callPackage ../os-specific/linux/sgx/psw {
+    protobuf = protobuf3_21;
+  };
 
   shadow = callPackage ../os-specific/linux/shadow { };
 
@@ -30382,6 +30431,7 @@ with pkgs;
 
   astroid = callPackage ../applications/networking/mailreaders/astroid {
     vim = vim-full.override { features = "normal"; };
+    protobuf = protobuf3_21;
   };
 
   aucatctl = callPackage ../applications/audio/aucatctl { };
@@ -31197,7 +31247,8 @@ with pkgs;
 
   ecs-agent = callPackage ../applications/virtualization/ecs-agent { };
 
-  ed = callPackage ../applications/editors/ed { };
+  inherit (recurseIntoAttrs (callPackage ../applications/editors/ed { }))
+    ed edUnstable;
 
   edbrowse = callPackage ../applications/editors/edbrowse { };
 
@@ -32398,7 +32449,9 @@ with pkgs;
     extra-packages = [ csound ];
   };
 
-  hyperion-ng = libsForQt5.callPackage ../applications/video/hyperion-ng { };
+  hyperion-ng = libsForQt5.callPackage ../applications/video/hyperion-ng {
+    protobuf = protobuf3_21;
+  };
 
   hyperledger-fabric = callPackage ../tools/misc/hyperledger-fabric { };
 
@@ -33885,13 +33938,14 @@ with pkgs;
       avahi = avahi-compat;
       pulseSupport = config.pulseaudio or false;
       iceSupport = config.murmur.iceSupport or true;
-      grpcSupport = config.murmur.grpcSupport or true;
+      protobuf = protobuf3_21;
     }).murmur;
 
   mumble = (callPackages ../applications/networking/mumble {
       avahi = avahi-compat;
       jackSupport = config.mumble.jackSupport or false;
       speechdSupport = config.mumble.speechdSupport or false;
+      protobuf = protobuf3_21;
     }).mumble;
 
   mumble_overlay = callPackage ../applications/networking/mumble/overlay.nix {
@@ -34015,7 +34069,9 @@ with pkgs;
 
   osm2pgsql = callPackage ../tools/misc/osm2pgsql { };
 
-  ostinato = libsForQt5.callPackage ../applications/networking/ostinato { };
+  ostinato = libsForQt5.callPackage ../applications/networking/ostinato {
+    protobuf = protobuf3_21;
+  };
 
   p4 = callPackage ../applications/version-management/p4 {
     inherit (darwin.apple_sdk.frameworks) CoreServices Foundation Security;
@@ -34119,6 +34175,7 @@ with pkgs;
 
   shogun = callPackage ../applications/science/machine-learning/shogun {
     opencv = opencv3;
+    protobuf = protobuf3_21;
   };
 
   smplayer = libsForQt5.callPackage ../applications/video/smplayer { };
@@ -35001,7 +35058,9 @@ with pkgs;
 
   rgp = libsForQt5.callPackage ../development/tools/rgp { };
 
-  ricochet = libsForQt5.callPackage ../applications/networking/instant-messengers/ricochet { };
+  ricochet = libsForQt5.callPackage ../applications/networking/instant-messengers/ricochet {
+    protobuf = protobuf3_21;
+  };
 
   ries = callPackage ../applications/science/math/ries { };
 
@@ -35325,7 +35384,10 @@ with pkgs;
 
   curaengine_stable = callPackage ../applications/misc/curaengine/stable.nix { };
 
-  curaengine = callPackage ../applications/misc/curaengine { inherit (python3.pkgs) libarcus; };
+  curaengine = callPackage ../applications/misc/curaengine {
+    inherit (python3.pkgs) libarcus;
+    protobuf = protobuf3_21;
+  };
 
   cura = libsForQt5.callPackage ../applications/misc/cura { };
 
@@ -35706,7 +35768,9 @@ with pkgs;
 
   tijolo = callPackage ../applications/editors/tijolo { };
 
-  tilemaker = callPackage ../applications/misc/tilemaker { };
+  tilemaker = callPackage ../applications/misc/tilemaker {
+    protobuf = protobuf3_21;
+  };
 
   timbreid = callPackage ../applications/audio/pd-plugins/timbreid {
     fftw = fftwSinglePrec;
@@ -36898,9 +36962,11 @@ with pkgs;
 
   bitcoin-abc  = libsForQt5.callPackage ../applications/blockchains/bitcoin-abc {
     withGui = true;
+    protobuf = protobuf3_21;
   };
   bitcoind-abc = callPackage ../applications/blockchains/bitcoin-abc {
     mkDerivation = stdenv.mkDerivation;
+    protobuf = protobuf3_21;
     withGui = false;
   };
 
@@ -37464,7 +37530,9 @@ with pkgs;
 
   ckan = callPackage ../games/ckan { };
 
-  cockatrice = libsForQt5.callPackage ../games/cockatrice {  };
+  cockatrice = libsForQt5.callPackage ../games/cockatrice {
+    protobuf = protobuf3_21;
+  };
 
   commandergenius = callPackage ../games/commandergenius { };
 
@@ -38058,10 +38126,13 @@ with pkgs;
 
   pong3d = callPackage ../games/pong3d { };
 
-  pokerth = libsForQt5.callPackage ../games/pokerth { };
+  pokerth = libsForQt5.callPackage ../games/pokerth {
+    protobuf = protobuf3_21;
+  };
 
   pokerth-server = libsForQt5.callPackage ../games/pokerth {
     target = "server";
+    protobuf = protobuf3_21;
   };
 
   pokete = callPackage ../games/pokete { };
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 79764a8133ab2..ed049340332c6 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -136,20 +136,10 @@ impure-cmds // appleSourcePackages // chooseLibs // {
 
   sigtool = callPackage ../os-specific/darwin/sigtool { };
 
-  postLinkSignHook = pkgs.writeTextFile {
-    name = "post-link-sign-hook";
-    executable = true;
-
-    text = ''
-      if [ "$linkerOutput" != "/dev/null" ]; then
-        CODESIGN_ALLOCATE=${targetPrefix}codesign_allocate \
-          ${self.sigtool}/bin/codesign -f -s - "$linkerOutput"
-      fi
-    '';
-  };
-
   signingUtils = callPackage ../os-specific/darwin/signing-utils { };
 
+  postLinkSignHook = callPackage ../os-specific/darwin/signing-utils/post-link-sign-hook.nix { };
+
   autoSignDarwinBinariesHook = pkgs.makeSetupHook {
     name = "auto-sign-darwin-binaries-hook";
     propagatedBuildInputs = [ self.signingUtils ];
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index c812be9edf2f3..8d15f5979d5c8 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -98,6 +98,7 @@ mapAliases ({
   django_classytags = django-classy-tags; # added 2023-07-25
   django_colorful = django-colorful; # added 2023-07-25
   django_compat = django-compat; # added 2023-07-25
+  django-compat = throw "django-compat has been removed. It provided forward/backport compat for django 1.x, which is long end of life."; # added 2023-07-26
   django_contrib_comments = django-contrib-comments; # added 2023-07-25
   django-discover-runner = throw "django-discover-runner was removed because it is no longer maintained."; # added 2022-11-21
   django_environ = django-environ; # added 2021-12-25
@@ -216,6 +217,7 @@ mapAliases ({
   mutmut = throw "mutmut has been promoted to a top-level attribute"; # added 2022-10-02
   net2grid = gridnet; # add 2022-04-22
   nghttp2 = throw "in 1.52.0 removed deprecated python bindings."; # added 2023-06-08
+  ninja-python = ninja; # add 2022-08-03
   nose-cover3 = throw "nose-cover3 has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; # added 2022-02-16
   nose_progressive = throw "nose_progressive has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; #added 2023-02-21
   notifymuch = throw "notifymuch has been promoted to a top-level attribute"; # added 2022-10-02
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9e5bd99704fa9..13fd1b1aa6b30 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2743,12 +2743,11 @@ self: super: with self; {
 
   distutils_extra = callPackage ../development/python-modules/distutils_extra { };
 
-  django = self.django_3;
-
-  # Current LTS
+  # LTS in extended support phase
   django_3 = callPackage ../development/python-modules/django/3.nix { };
 
-  # Current latest
+  # LTS with mainsteam support
+  django = self.django_4;
   django_4 = callPackage ../development/python-modules/django/4.nix { };
 
   django-admin-datta = callPackage ../development/python-modules/django-admin-datta { };
@@ -2793,8 +2792,6 @@ self: super: with self; {
 
   django-colorful = callPackage ../development/python-modules/django-colorful { };
 
-  django-compat = callPackage ../development/python-modules/django-compat { };
-
   django-compressor = callPackage ../development/python-modules/django-compressor { };
 
   django-compression-middleware = callPackage ../development/python-modules/django-compression-middleware { };
@@ -3694,6 +3691,8 @@ self: super: with self; {
 
   ffmpeg-progress-yield = callPackage ../development/python-modules/ffmpeg-progress-yield { };
 
+  ffmpy = callPackage ../development/python-modules/ffmpy { };
+
   fiblary3-fork = callPackage ../development/python-modules/fiblary3-fork { };
 
   fido2 = callPackage ../development/python-modules/fido2 { };
@@ -4500,6 +4499,8 @@ self: super: with self; {
 
   gradient_statsd = callPackage ../development/python-modules/gradient_statsd { };
 
+  gradio = callPackage ../development/python-modules/gradio { };
+
   grammalecte = callPackage ../development/python-modules/grammalecte { };
 
   grandalf = callPackage ../development/python-modules/grandalf { };
@@ -5871,7 +5872,7 @@ self: super: with self; {
   };
 
   libarcus = callPackage ../development/python-modules/libarcus {
-    inherit (pkgs) protobuf;
+    protobuf = pkgs.protobuf3_21;
   };
 
   libasyncns = callPackage ../development/python-modules/libasyncns {
@@ -6486,7 +6487,9 @@ self: super: with self; {
 
   mesonpep517 = callPackage ../development/python-modules/mesonpep517 { };
 
-  meson-python = callPackage ../development/python-modules/meson-python { };
+  meson-python = callPackage ../development/python-modules/meson-python {
+    inherit (pkgs) ninja;
+  };
 
   messagebird = callPackage ../development/python-modules/messagebird { };
 
@@ -7083,7 +7086,7 @@ self: super: with self; {
 
   nine = callPackage ../development/python-modules/nine { };
 
-  ninja-python = callPackage ../development/python-modules/ninja { };
+  ninja = callPackage ../development/python-modules/ninja { inherit (pkgs) ninja; };
 
   nipy = callPackage ../development/python-modules/nipy { };
 
@@ -7366,9 +7369,13 @@ self: super: with self; {
 
   onlykey-solo-python = callPackage ../development/python-modules/onlykey-solo-python { };
 
-  onnx = callPackage ../development/python-modules/onnx { };
+  onnx = callPackage ../development/python-modules/onnx {
+    protobuf = protobuf3;
+  };
 
-  onnxconverter-common = callPackage ../development/python-modules/onnxconverter-common { };
+  onnxconverter-common = callPackage ../development/python-modules/onnxconverter-common {
+    protobuf = protobuf3;
+  };
 
   onnxmltools = callPackage ../development/python-modules/onnxmltools { };
 
@@ -11705,7 +11712,9 @@ self: super: with self; {
 
   skidl = callPackage ../development/python-modules/skidl { };
 
-  skl2onnx = callPackage ../development/python-modules/skl2onnx { };
+  skl2onnx = callPackage ../development/python-modules/skl2onnx {
+    protobuf = protobuf3;
+  };
 
   sklearn-deap = callPackage ../development/python-modules/sklearn-deap { };