diff --git a/nixos/modules/services/hardware/pcscd.nix b/nixos/modules/services/hardware/pcscd.nix
index 44d0d3b04a39..a09c64645c48 100644
--- a/nixos/modules/services/hardware/pcscd.nix
+++ b/nixos/modules/services/hardware/pcscd.nix
@@ -5,6 +5,10 @@ with lib;
 let
   cfgFile = pkgs.writeText "reader.conf" config.services.pcscd.readerConfig;
 
+  package = if config.security.polkit.enable
+              then pkgs.pcscliteWithPolkit
+              else pkgs.pcsclite;
+
   pluginEnv = pkgs.buildEnv {
     name = "pcscd-plugins";
     paths = map (p: "${p}/pcsc/drivers") config.services.pcscd.plugins;
@@ -49,8 +53,8 @@ in
 
     environment.etc."reader.conf".source = cfgFile;
 
-    environment.systemPackages = [ pkgs.pcsclite ];
-    systemd.packages = [ (getBin pkgs.pcsclite) ];
+    environment.systemPackages = [ package ];
+    systemd.packages = [ (getBin package) ];
 
     systemd.sockets.pcscd.wantedBy = [ "sockets.target" ];
 
@@ -66,7 +70,7 @@ in
       # around it, we force the path to the cfgFile.
       #
       # https://github.com/NixOS/nixpkgs/issues/121088
-      serviceConfig.ExecStart = [ "" "${getBin pkgs.pcsclite}/bin/pcscd -f -x -c ${cfgFile}" ];
+      serviceConfig.ExecStart = [ "" "${getBin package}/bin/pcscd -f -x -c ${cfgFile}" ];
     };
   };
 }
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index 1c0ddd1942d3..09abaa862f51 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.2.9";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    sha256 = "sha256-8vsYn/4qkANp6f6avtdaXHfJD+9NTHTrl7i4RTlKXPQ=";
+    sha256 = "sha256-7SuM7a8IIecAJ83QvJfUba/wArAEXywqL2HwVbeG8H4=";
   };
 
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];
diff --git a/pkgs/applications/networking/qv2ray/default.nix b/pkgs/applications/networking/qv2ray/default.nix
index 62327a8e9a89..3e6dfb1a7d22 100644
--- a/pkgs/applications/networking/qv2ray/default.nix
+++ b/pkgs/applications/networking/qv2ray/default.nix
@@ -11,7 +11,6 @@
 , openssl
 , pkg-config
 , c-ares
-, abseil-cpp
 , libGL
 , zlib
 , curl
@@ -51,7 +50,6 @@ mkDerivation rec {
     grpc
     protobuf
     openssl
-    abseil-cpp
     c-ares
   ];
 
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index dd244b3687c1..2d63ae403791 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -28,7 +28,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.38.0";
+  version = "2.38.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-kj6t4msYFN540GvajgqfXai3xLMEs/kFD/tGTwMQMgo=";
+    sha256 = "sha256-l9346liiueD7wlCOJFAoynWRG9ONFVFhaxSMGqV0Ctk=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -207,6 +207,7 @@ stdenv.mkDerivation (finalAttrs: {
       # Also put git-http-backend into $PATH, so that we can use smart
       # HTTP(s) transports for pushing
       ln -s $out/libexec/git-core/git-http-backend $out/bin/git-http-backend
+      ln -s $out/share/git/contrib/git-jump/git-jump $out/bin/git-jump
     '' + lib.optionalString perlSupport ''
       # wrap perl commands
       makeWrapper "$out/share/git/contrib/credential/netrc/git-credential-netrc.perl" $out/bin/git-credential-netrc \
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index f199b1d7e247..14cd1d431391 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -274,9 +274,7 @@ stdenv.mkDerivation {
 
   setupHooks = [
     ../setup-hooks/role.bash
-  ] ++ lib.optional (cc.langC or true)
-        # Temporary hack; see https://github.com/NixOS/nixpkgs/pull/191724#issuecomment-1278602576
-        (if stdenv.isLinux then ./setup-hook.sh else ./setup-hook-nonlinux.sh)
+  ] ++ lib.optional (cc.langC or true) ./setup-hook.sh
     ++ lib.optional (cc.langFortran or false) ./fortran-hook.sh;
 
   postFixup =
diff --git a/pkgs/build-support/cc-wrapper/setup-hook-nonlinux.sh b/pkgs/build-support/cc-wrapper/setup-hook-nonlinux.sh
deleted file mode 100644
index 6a913cc4eac7..000000000000
--- a/pkgs/build-support/cc-wrapper/setup-hook-nonlinux.sh
+++ /dev/null
@@ -1,120 +0,0 @@
-# CC Wrapper hygiene
-#
-# For at least cross compilation, we need to depend on multiple cc-wrappers at
-# once---specifically up to one per sort of dependency. This follows from having
-# different tools targeting different platforms, and different flags for those
-# tools. For example:
-#
-#   # Flags for compiling (whether or not linking) C code for the...
-#   NIX_CFLAGS_COMPILE_FOR_BUILD  # ...build platform
-#   NIX_CFLAGS_COMPILE            # ...host platform
-#   NIX_CFLAGS_COMPILE_FOR_TARGET # ...target platform
-#
-# Notice that these platforms are the 3 *relative* to the package using
-# cc-wrapper, not absolute like `x86_64-pc-linux-gnu`.
-#
-# The simplest solution would be to have separate cc-wrappers per (3 intended
-# use-cases * n absolute concrete platforms). For the use-case axis, we would
-# @-splice in 'BUILD_' '' 'TARGET_' to use the write environment variables when
-# building the cc-wrapper, and likewise prefix the binaries' names so they didn't
-# clobber each other on the PATH. But the need for 3x cc-wrappers, along with
-# non-standard name prefixes, is annoying and liable to break packages' build
-# systems.
-#
-# Instead, we opt to have just one cc-wrapper per absolute platform. Matching
-# convention, the binaries' names can just be prefixed with their target
-# platform. On the other hand, that means packages will depend on not just
-# multiple cc-wrappers, but the exact same cc-wrapper derivation multiple ways.
-# That means the exact same cc-wrapper derivation must be able to avoid
-# conflicting with itself, despite the fact that `setup-hook.sh`, the `addCvars`
-# function, and `add-flags.sh` are all communicating with each other with
-# environment variables. Yuck.
-#
-# The basic strategy is:
-#
-#  - Everyone exclusively *adds information* to relative-platform-specific
-#    environment variables, like `NIX_CFLAGS_COMPILE_FOR_TARGET`, to communicate
-#    with the wrapped binaries.
-#
-#  - The wrapped binaries will exclusively *read* cc-wrapper-derivation-specific
-#    environment variables distinguished with with `suffixSalt`, like
-#    `NIX_CFLAGS_COMPILE_@suffixSalt@`.
-#
-#  - `add-flags`, beyond its old task of reading extra flags stuck inside the
-#    cc-wrapper derivation, will convert the relative-platform-specific
-#    variables to cc-wrapper-derivation-specific variables. This conversion is
-#    the only time all but one of the cc-wrapper-derivation-specific variables
-#    are set.
-#
-# This ensures the flow of information is exclusive from
-# relative-platform-specific variables to cc-wrapper-derivation-specific
-# variables. This allows us to support the general case of a many--many relation
-# between relative platforms and cc-wrapper derivations.
-#
-# For more details, read the individual files where the mechanisms used to
-# accomplish this will be individually documented.
-
-# Skip setup hook if we're neither a build-time dep, nor, temporarily, doing a
-# native compile.
-#
-# TODO(@Ericson2314): No native exception
-[[ -z ${strictDeps-} ]] || (( "$hostOffset" < 0 )) || return 0
-
-# It's fine that any other cc-wrapper will redefine this. Bash functions close
-# over no state, and there's no @-substitutions within, so any redefined
-# function is guaranteed to be exactly the same.
-ccWrapper_addCVars () {
-    # See ../setup-hooks/role.bash
-    local role_post
-    getHostRoleEnvHook
-
-    if [ -d "$1/include" ]; then
-        export NIX_CFLAGS_COMPILE${role_post}+=" -isystem $1/include"
-    fi
-
-    if [ -d "$1/Library/Frameworks" ]; then
-        export NIX_CFLAGS_COMPILE${role_post}+=" -iframework $1/Library/Frameworks"
-    fi
-}
-
-# See ../setup-hooks/role.bash
-getTargetRole
-getTargetRoleWrapper
-
-# We use the `targetOffset` to choose the right env hook to accumulate the right
-# sort of deps (those with that offset).
-addEnvHooks "$targetOffset" ccWrapper_addCVars
-
-# Note 1: these come *after* $out in the PATH (see setup.sh).
-# Note 2: phase separation makes this look useless to shellcheck.
-
-# shellcheck disable=SC2157
-if [ -n "@cc@" ]; then
-    addToSearchPath _PATH @cc@/bin
-fi
-
-# shellcheck disable=SC2157
-if [ -n "@libc_bin@" ]; then
-    addToSearchPath _PATH @libc_bin@/bin
-fi
-
-# shellcheck disable=SC2157
-if [ -n "@coreutils_bin@" ]; then
-    addToSearchPath _PATH @coreutils_bin@/bin
-fi
-
-# Export tool environment variables so various build systems use the right ones.
-
-export NIX_CC${role_post}=@out@
-
-export CC${role_post}=@named_cc@
-export CXX${role_post}=@named_cxx@
-export CC${role_post}=@named_cc@
-export CXX${role_post}=@named_cxx@
-
-# If unset, assume the default hardening flags.
-: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
-export NIX_HARDENING_ENABLE
-
-# No local scope in sourced file
-unset -v role_post
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 94ca721cd914..be01c51a71ff 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -69,12 +69,10 @@ ccWrapper_addCVars () {
     getHostRoleEnvHook
 
     if [ -d "$1/include" ]; then
-        (! echo "$NIX_CFLAGS_COMPILE" | grep -q -F "$1/include") &&
         export NIX_CFLAGS_COMPILE${role_post}+=" -isystem $1/include"
     fi
 
     if [ -d "$1/Library/Frameworks" ]; then
-        (! echo "$NIX_CFLAGS_COMPILE" | grep -q -F "$1/Library/Frameworks") &&
         export NIX_CFLAGS_COMPILE${role_post}+=" -iframework $1/Library/Frameworks"
     fi
 }
@@ -109,8 +107,6 @@ fi
 
 export NIX_CC${role_post}=@out@
 
-export CC${role_post}=@named_cc@
-export CXX${role_post}=@named_cxx@
 export CC${role_post}=@named_cc@
 export CXX${role_post}=@named_cxx@
 
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index 1dd303170936..dddf7a2b63d5 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = "sdk-${version}";
-    hash = "sha256-VEOENuy/VhYBBX52O4QHJFXUjsj6jL4vDD4cLDlQcIA=";
+    hash = "sha256-huPrQr+lPi7QCF8CufAavHEKGDDimGrcskiojhH9QYk=";
   };
 
   # These get set at all-packages, keep onto them for child drvs
diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix
index 7490aa8a2484..07a590f38845 100644
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.18.7";
+  version = "1.18.8";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-lGfjO4Gfcb67IfsO4d1nlP0iRK6UkHqYQoZxL5g5qUQ=";
+    sha256 = "sha256-H3mAIwUBVHnnfYxkFTC8VOyZRlfVxSceAXLrcRg0ahI=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 0017bd8c482c..0d977ec3af3a 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.19.2";
+  version = "1.19.3";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-LOkw1wqTHeZg/a8nHXAZJ5OxskAnJkW/AnV3n2cE32s=";
+    sha256 = "sha256-GKwmPjkhC89o2F9DcOl/sXNBZplaH2P7OLT24H2Q0hI=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/X86-support-extension.patch b/pkgs/development/compilers/llvm/10/compiler-rt/X86-support-extension.patch
new file mode 100644
index 000000000000..f6f9336ad5ad
--- /dev/null
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/X86-support-extension.patch
@@ -0,0 +1,23 @@
+diff --git a/lib/builtins/CMakeLists.txt b/lib/builtins/CMakeLists.txt
+index 3a66dd9c3fb..7efc85d9f9f 100644
+--- a/lib/builtins/CMakeLists.txt
++++ b/lib/builtins/CMakeLists.txt
+@@ -301,6 +301,10 @@ if (NOT MSVC)
+     i386/umoddi3.S
+   )
+ 
++  set(i486_SOURCES ${i386_SOURCES})
++  set(i586_SOURCES ${i386_SOURCES})
++  set(i686_SOURCES ${i386_SOURCES})
++
+   if (WIN32)
+     set(i386_SOURCES
+       ${i386_SOURCES}
+@@ -608,6 +612,7 @@ else ()
+   endif()
+ 
+   foreach (arch ${BUILTIN_SUPPORTED_ARCH})
++      message("arch: ${arch}")
+     if (CAN_TARGET_${arch})
+       # For ARM archs, exclude any VFP builtins if VFP is not supported
+       if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em)$")
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
index 4ae59a431770..0302f2ad3092 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@@ -46,9 +46,7 @@ stdenv.mkDerivation {
   ] ++ lib.optionals (bareMetal) [
     "-DCOMPILER_RT_OS_DIR=baremetal"
   ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-    # The compiler-rt build infrastructure sniffs supported platforms on Darwin
-    # and finds i386;x86_64;x86_64h. We only build for x86_64, so linking fails
-    # when it tries to use libc++ and libc++api for i386.
+    "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=ON"
     "-DDARWIN_osx_ARCHS=${stdenv.hostPlatform.darwinArch}"
     "-DDARWIN_osx_BUILTIN_ARCHS=${stdenv.hostPlatform.darwinArch}"
   ];
@@ -60,6 +58,7 @@ stdenv.mkDerivation {
     ./find-darwin-sdk-version.patch # don't test for macOS being >= 10.15
     ./gnu-install-dirs.patch
     ../../common/compiler-rt/libsanitizer-no-cyclades-11.patch
+    ./X86-support-extension.patch # backported from LLVM 11
   ] ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
@@ -70,6 +69,8 @@ stdenv.mkDerivation {
   postPatch = lib.optionalString (!stdenv.isDarwin) ''
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+    substituteInPlace cmake/config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + lib.optionalString stdenv.isDarwin ''
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
@@ -88,8 +89,16 @@ stdenv.mkDerivation {
   '' + lib.optionalString (useLLVM) ''
     ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbegin.o
     ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtend.o
+    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbeginS.o
+    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtendS.o
     ln -s $out/lib/*/clang_rt.crtbegin_shared-*.o $out/lib/crtbeginS.o
     ln -s $out/lib/*/clang_rt.crtend_shared-*.o $out/lib/crtendS.o
+  ''
+  # See https://reviews.llvm.org/D37278 for why android exception
+  + lib.optionalString (stdenv.hostPlatform.isx86_32 && !stdenv.hostPlatform.isAndroid) ''
+    for f in $out/lib/*/*builtins-i?86*; do
+      ln -s "$f" $(echo "$f" | sed -e 's/builtins-i.86/builtins-i386/')
+    done
   '';
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index 6790910ee830..e4ba52030ba4 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -78,6 +78,8 @@ stdenv.mkDerivation {
   postPatch = lib.optionalString (!stdenv.isDarwin) ''
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+    substituteInPlace cmake/config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + lib.optionalString stdenv.isDarwin ''
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
@@ -96,8 +98,16 @@ stdenv.mkDerivation {
   '' + lib.optionalString (useLLVM) ''
     ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbegin.o
     ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtend.o
+    ln -s $out/lib/*/clang_rt.crtbegin-*.o $out/lib/crtbeginS.o
+    ln -s $out/lib/*/clang_rt.crtend-*.o $out/lib/crtendS.o
     ln -s $out/lib/*/clang_rt.crtbegin_shared-*.o $out/lib/crtbeginS.o
     ln -s $out/lib/*/clang_rt.crtend_shared-*.o $out/lib/crtendS.o
+  ''
+  # See https://reviews.llvm.org/D37278 for why android exception
+  + lib.optionalString (stdenv.hostPlatform.isx86_32 && !stdenv.hostPlatform.isAndroid) ''
+    for f in $out/lib/*/*builtins-i?86*; do
+      ln -s "$f" $(echo "$f" | sed -e 's/builtins-i.86/builtins-i386/')
+    done
   '';
 
   meta = llvm_meta // {
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index 82a78af85cac..c3abface37eb 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -43,6 +43,7 @@ let
       mkdir "$rsrc"
       ln -s "${cc.lib}/lib/clang/${release_version}/include" "$rsrc"
       echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+      echo "-B $rsrc/lib" >> $out/nix-support/cc-cflags
     '';
     mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
       ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index dc67dcfd2a33..8288cd5c61e3 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -2,7 +2,7 @@
 , llvmShared, llvmSharedForBuild, llvmSharedForHost, llvmSharedForTarget, llvmPackages
 , fetchurl, file, python3
 , darwin, cmake, rust, rustPlatform
-, pkg-config, openssl
+, pkg-config, openssl, xz
 , libiconv
 , which, libffi
 , withBundledLLVM ? false
@@ -41,6 +41,13 @@ in stdenv.mkDerivation rec {
   # See: https://github.com/NixOS/nixpkgs/pull/56540#issuecomment-471624656
   stripDebugList = [ "bin" ];
 
+  # The Rust pkg-config crate does not support prefixed pkg-config executables[1],
+  # but it does support checking these idiosyncratic PKG_CONFIG_${TRIPLE}
+  # environment variables.
+  # [1]: https://github.com/rust-lang/pkg-config-rs/issues/53
+  "PKG_CONFIG_${builtins.replaceStrings ["-"] ["_"] (rust.toRustTarget stdenv.buildPlatform)}" =
+    "${pkgsBuildHost.stdenv.cc.targetPrefix}pkg-config";
+
   NIX_LDFLAGS = toString (
        # when linking stage1 libstd: cc: undefined reference to `__cxa_begin_catch'
        optional (stdenv.isLinux && !withBundledLLVM) "--push-state --as-needed -lstdc++ --pop-state"
@@ -148,9 +155,11 @@ in stdenv.mkDerivation rec {
   # use it for the normal build. This disables cmake in Nix.
   dontUseCmakeConfigure = true;
 
+  depsBuildBuild = [ pkgsBuildHost.stdenv.cc pkg-config ];
+
   nativeBuildInputs = [
     file python3 rustPlatform.rust.rustc cmake
-    which libffi removeReferencesTo pkg-config
+    which libffi removeReferencesTo pkg-config xz
   ];
 
   buildInputs = [ openssl ]
diff --git a/pkgs/development/interpreters/guile/2.0.nix b/pkgs/development/interpreters/guile/2.0.nix
index 73fb564077a3..9e2953aa2f9e 100644
--- a/pkgs/development/interpreters/guile/2.0.nix
+++ b/pkgs/development/interpreters/guile/2.0.nix
@@ -120,7 +120,7 @@ builder rec {
   + ''
     sed -i "$out/lib/pkgconfig/guile"-*.pc    \
         -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
-            s|^Cflags:\(.*\)$|Cflags: -I${libunistring}/include \1|g ;
+            s|^Cflags:\(.*\)$|Cflags: -I${libunistring.dev}/include \1|g ;
             s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
             s|includedir=$out|includedir=$dev|g
             "
diff --git a/pkgs/development/interpreters/guile/2.2.nix b/pkgs/development/interpreters/guile/2.2.nix
index 31803d9c1665..c101f5ae3903 100644
--- a/pkgs/development/interpreters/guile/2.2.nix
+++ b/pkgs/development/interpreters/guile/2.2.nix
@@ -111,7 +111,7 @@ builder rec {
   + ''
     sed -i "$out/lib/pkgconfig/guile"-*.pc    \
         -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
-            s|^Cflags:\(.*\)$|Cflags: -I${libunistring}/include \1|g ;
+            s|^Cflags:\(.*\)$|Cflags: -I${libunistring.dev}/include \1|g ;
             s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
             s|includedir=$out|includedir=$dev|g
             "
diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
index b7ad4e4ec727..ced8561720d3 100644
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -114,7 +114,7 @@ builder rec {
   + ''
     sed -i "$out/lib/pkgconfig/guile"-*.pc    \
         -e "s|-lunistring|-L${libunistring}/lib -lunistring|g ;
-            s|^Cflags:\(.*\)$|Cflags: -I${libunistring}/include \1|g ;
+            s|^Cflags:\(.*\)$|Cflags: -I${libunistring.dev}/include \1|g ;
             s|-lltdl|-L${libtool.lib}/lib -lltdl|g ;
             s|includedir=$out|includedir=$dev|g
             "
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index f6a43a49c19a..12f9c50535d0 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -121,19 +121,19 @@
       sourceVersion = {
         major = "3";
         minor = "9";
-        patch = "14";
+        patch = "15";
         suffix = "";
       };
-      sha256 = "sha256-ZRME0hbIID/grfGoCvRy2OksOw4KeJIiKuTZ865N688=";
+      sha256 = "sha256-Etr/aAlSjZ9hVCFpUEI8njDw5HM2y1fGqgtDh91etLI=";
     };
     python310 = {
       sourceVersion = {
         major = "3";
         minor = "10";
-        patch = "7";
+        patch = "8";
         suffix = "";
       };
-      sha256 = "sha256-bu2EFbdRb7LyYJBttdSN1MBqzAyySn1swVKWpgTc3Eg=";
+      sha256 = "sha256-ajDs3lnEcEgBPrWmWMm13sJ3ID0nk2Z/V433Zx9/A/M=";
     };
   };
 
diff --git a/pkgs/development/libraries/abseil-cpp/202206.nix b/pkgs/development/libraries/abseil-cpp/202206.nix
new file mode 100644
index 000000000000..7ca25f414040
--- /dev/null
+++ b/pkgs/development/libraries/abseil-cpp/202206.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, static ? stdenv.hostPlatform.isStatic
+, cxxStandard ? null
+}:
+
+stdenv.mkDerivation rec {
+  pname = "abseil-cpp";
+  version = "20220623.1";
+
+  src = fetchFromGitHub {
+    owner = "abseil";
+    repo = "abseil-cpp";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Od1FZOOWEXVQsnZBwGjDIExi6LdYtomyL0STR44SsG8=";
+  };
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
+  ] ++ lib.optionals (cxxStandard != null) [
+    "-DCMAKE_CXX_STANDARD=${cxxStandard}"
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "An open-source collection of C++ code designed to augment the C++ standard library";
+    homepage = "https://abseil.io/";
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = [ maintainers.andersk ];
+  };
+}
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index a72ebc293092..2ce613c78534 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -3,7 +3,6 @@
 , fetchurl
 , fetchFromGitHub
 , fixDarwinDylibNames
-, abseil-cpp
 , autoconf
 , aws-sdk-cpp
 , boost
@@ -147,10 +146,9 @@ stdenv.mkDerivation rec {
     protobuf
   ] ++ lib.optionals enableS3 [ aws-sdk-cpp openssl ]
   ++ lib.optionals enableGcs [
-    abseil-cpp
     crc32c
     curl
-    google-cloud-cpp
+    google-cloud-cpp grpc
     nlohmann_json
   ];
 
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index e70a8210df87..eaa80586f475 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.3.2";
+  version = "2.3.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-zpukf9TTQDG9aURVmKaYpmEWArKw6R1wXpGm9QmerW4=";
+    sha256 = "sha256-PaEhA/Ec9Jw88v0s4wF1dcUyGkieW5v6gd2R7EE/OJE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/faad2/default.nix b/pkgs/development/libraries/faad2/default.nix
index eb6915c7e67c..e62a90fcd2bf 100644
--- a/pkgs/development/libraries/faad2/default.nix
+++ b/pkgs/development/libraries/faad2/default.nix
@@ -14,13 +14,13 @@
 with lib;
 stdenv.mkDerivation rec {
   pname = "faad2";
-  version = "2.10.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "knik0";
     repo = "faad2";
-    rev = builtins.replaceStrings [ "." ] [ "_" ] version;
-    sha256 = "0q52kdd95ls6ihzyspx176wg9x22425v5qsknrmrjq30q25qmmlg";
+    rev = version;
+    sha256 = "sha256-k7y12OwCn3YkNZY9Ov5Y9EQtlrZh6oFUzM27JDR960w=";
   };
 
   configureFlags = []
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 87b93a868985..5d9b41848cae 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -71,6 +71,7 @@ stdenv.mkDerivation rec {
   configureFlags = filter (v: v != null) ([
       "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
       "--target_os=${stdenv.hostPlatform.parsed.kernel.name}"
+      "--pkg-config=${pkg-config.targetPrefix}pkg-config"
     # License
       "--enable-gpl"
       "--enable-version3"
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index ae7d7460487a..87d3285e64bc 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gdk-pixbuf";
-  version = "2.42.9";
+  version = "2.42.10";
 
   outputs = [ "out" "dev" "man" "devdoc" ]
     ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) "installedTests";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "KPeVjnvymjLU6WNVbSQdCkGmeGWC/2pa0RZl4DR/yWI=";
+    sha256 = "7ptsddE7oJaQei48aye2G80X9cfr6rWltDnS8uOf5Es=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index 18acca3f6915..fb2929a72f16 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, abseil-cpp
 , c-ares
 , cmake
 , crc32c
@@ -66,7 +65,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    abseil-cpp
     c-ares
     crc32c
     (curl.override { inherit openssl; })
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index d44b85337ddc..3858ac7c437f 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.48.1"; # N.B: if you change this, please update:
+  version = "1.50.0"; # N.B: if you change this, please update:
     # pythonPackages.grpcio-tools
     # pythonPackages.grpcio-status
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-It9oFenKoPDCOVxiKCGJc8i18zdDZCceR22HR5Tu1sw=";
+    hash = "sha256-h79Ptx17tIMFpaaid4UGzbGDztee9JctfsEcetfude0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 5ec8c75e2af7..9bee726e5003 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -3,6 +3,9 @@
 , enableVmaf ? true, libvmaf
 }:
 
+let
+  isCross = stdenv.buildPlatform != stdenv.hostPlatform;
+in
 stdenv.mkDerivation rec {
   pname = "libaom";
   version = "3.5.0";
@@ -45,7 +48,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # CPU detection isn't supported on Darwin and breaks the aarch64-darwin build:
     "-DCONFIG_RUNTIME_CPU_DETECT=0"
-  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+  ] ++ lib.optionals (isCross && !stdenv.hostPlatform.isx86) [
     "-DAS_EXECUTABLE=${stdenv.cc.targetPrefix}as"
   ] ++ lib.optionals stdenv.isAarch32 [
     # armv7l-hf-multiplatform does not support NEON
@@ -55,6 +58,8 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     moveToOutput lib/libaom.a "$static"
+  '' + lib.optionalString stdenv.hostPlatform.isStatic ''
+    ln -s $static $out
   '';
 
   outputs = [ "out" "bin" "dev" "static" ];
@@ -70,6 +75,7 @@ stdenv.mkDerivation rec {
     changelog   = "https://aomedia.googlesource.com/aom/+/refs/tags/v${version}/CHANGELOG";
     maintainers = with maintainers; [ primeos kiloreux dandellion ];
     platforms   = platforms.all;
+    outputsToInstall = [ "bin" ];
     license = licenses.bsd2;
   };
 }
diff --git a/pkgs/development/libraries/libavif/default.nix b/pkgs/development/libraries/libavif/default.nix
index d5a2a686b893..64e1657bcba4 100644
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@@ -7,6 +7,7 @@
 , libpng
 , libjpeg
 , dav1d
+, libyuv
 }:
 
 stdenv.mkDerivation rec {
@@ -41,6 +42,7 @@ stdenv.mkDerivation rec {
     libpng
     libjpeg
     dav1d
+    libyuv
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index 762fe1765fd2..d054e223cf0d 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -1,28 +1,37 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+
+# for passthru.tests
+, imagemagick
+, imagemagick6
+, libheif
+, imlib2Full
+, gst_all_1
+}:
 
 stdenv.mkDerivation rec {
-  version = "1.0.8";
+  version = "1.0.9";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "1dzflqbk248lz5ws0ni5acmf32b3rmnq5gsfaz7691qqjxkl1zml";
+    sha256 = "sha256-OpiQapppuKCR27tIG5OW+KiNMP9ysv7CaobiBOW6VUI=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2022-1253.patch";
-      url = "https://github.com/strukturag/libde265/commit/8e89fe0e175d2870c39486fdd09250b230ec10b8.patch";
-      sha256 = "sha256-F1BOWFx9oXR2trM22atyD3AJ5x6vVfURQ/PTlYP2Ibg=";
-    })
-  ];
-
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   enableParallelBuilding = true;
 
+  passthru.tests = {
+    inherit imagemagick imagemagick6 libheif imlib2Full;
+    inherit (gst_all_1) gst-plugins-bad;
+  };
+
   meta = {
     homepage = "https://github.com/strukturag/libde265";
     description = "Open h.265 video codec implementation";
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 72ecdc51ab13..354b73f80507 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
     "-Dinstall-test-programs=true"
     "-Domap=enabled"
     "-Dcairo-tests=disabled"
+    "-Dvalgrind=${if withValgrind then "enabled" else "disabled"}"
   ] ++ lib.optionals stdenv.hostPlatform.isAarch [
     "-Dtegra=enabled"
     "-Detnaviv=enabled"
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index 2904e6e45671..02721ff8d9be 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -5,15 +5,16 @@
   # dejagnu also requires tcl which can't be built statically at the moment
 , doCheck ? !(stdenv.hostPlatform.isStatic)
 , dejagnu
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "libffi";
-  version = "3.4.3";
+  version = "3.4.4";
 
   src = fetchurl {
     url = "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-RBbdkrauj8tbEEIecRxNPLMSA9d1Iad9hdAQIxHmw7g=";
+    sha256 = "sha256-1mxWrSWags8qnfxAizK/XaUjcVALhHRff7i2RXEt9nY=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -52,6 +53,12 @@ stdenv.mkDerivation rec {
 
   checkInputs = [ dejagnu ];
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "A foreign function call interface library";
     longDescription = ''
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 3e03d18ced85..760fc88e98ec 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchurl
 , buildPackages
 , cmake
 , glib
@@ -20,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.15";
+  version = "3.0.16";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -28,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "sha256-7M5GBteFKmKCB6556XXV4s6iIC/+3c3Ck17s/QX3Jus=";
+    sha256 = "sha256-3D/0leI3LLKDFOXkKSrmMamLoaXdi/2Z4iPUXqgwtg8=";
   };
 
   strictDeps = true;
@@ -75,17 +74,6 @@ stdenv.mkDerivation rec {
     # Will appear in 3.1.0
     # https://github.com/libical/libical/issues/350
     ./respect-env-tzdir.patch
-
-    # Fixes tests with 32-bit time_t
-    # Remove with next version update (v3.0.16+)
-    (fetchurl {
-      url = "https://github.com/libical/libical/commit/4adc6f1d2b39a1cc3363b57215e12fa81076498b.patch";
-      sha256 = "1k3hav0z86kc1xd1sk23b57aqqjk4gf73574w7f1m66cyz98bxr3";
-    })
-    (fetchurl {
-      url = "https://github.com/libical/libical/commit/cce20bd051408b00521385c0bfb616ba068450d3.patch";
-      sha256 = "097hqmagl0q5p38r1kvx0592cfac2y7jbdqlis6m8gbs812pbqfc";
-    })
   ];
 
   # Using install check so we do not have to manually set
diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/development/libraries/libsoup/3.x.nix
index af7d640b6de1..a5c6498166f5 100644
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , glib
 , meson
 , ninja
@@ -11,9 +10,7 @@
 , sqlite
 , glib-networking
 , gobject-introspection
-, withIntrospection ? stdenv.buildPlatform == stdenv.hostPlatform
 , vala
-, withVala ? stdenv.buildPlatform == stdenv.hostPlatform
 , libpsl
 , python3
 , gi-docgen
@@ -23,21 +20,17 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.2.0";
+  version = "3.2.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-KDI3BpjKj5+/F0w0W3PYm2BWEQOmJsLfcHJrBwf3m9M=";
+    sha256 = "sha256-ses9LDvkn7vQUacfZTLJYmvOzqaXgxkGkM1+Tf3yjyk=";
   };
 
-  # https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/310
-  patches = [
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libsoup/-/commit/0fae143dc8b0e668b7a35a9c1364009e7cf06d0f.patch";
-      sha256 = "sha256-yAKC7WGk0aQxMkT4At6Qfx1QO2InNotITrl/Lim41Jk=";
-    })
+  depsBuildBuild = [
+    pkg-config
   ];
 
   nativeBuildInputs = [
@@ -47,9 +40,7 @@ stdenv.mkDerivation rec {
     glib
     python3
     gi-docgen
-  ] ++ lib.optionals withIntrospection [
     gobject-introspection
-  ] ++ lib.optionals withVala [
     vala
   ];
 
@@ -70,8 +61,8 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Dtls_check=false" # glib-networking is a runtime dependency, not a compile-time dependency
     "-Dgssapi=disabled"
-    "-Dvapi=${if withVala then "enabled" else "disabled"}"
-    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
+    "-Dvapi=enabled"
+    "-Dintrospection=enabled"
     "-Dntlm=disabled"
     # Requires wstest from autobahn-testsuite.
     "-Dautobahn=disabled"
diff --git a/pkgs/development/libraries/libsoup/default.nix b/pkgs/development/libraries/libsoup/default.nix
index 9976f4109f0e..df753b55b08c 100644
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "2.74.2";
+  version = "2.74.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-8KQnZW5f4Z4d9xwQfojfobLmc8JcVHt4I7YBi0DQEVk=";
+    sha256 = "sha256-5Ld8Qc/EyMWgNfzcMgx7xs+3XvfFoDQVPfFBP6HZLxM=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index a87513174fb7..82f3b97f6f05 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -46,6 +46,17 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.com/libtiff/libtiff/-/commit/48d6ece8389b01129e7d357f0985c8f938ce3da3.patch";
       sha256 = "sha256-h9hulV+dnsUt/2Rsk4C1AKdULkvweM2ypIJXYQ3BqQU=";
     })
+    (fetchpatch {
+      name = "CVE-2022-3626.CVE-2022-3627.CVE-2022-3597.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047.patch";
+      excludes = [ "doc/tools/tiffcrop.rst" ];
+      sha256 = "sha256-L2EMmmfMM4oEYeLapO93wvNS+HlO0yXsKxijXH+Wuas=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-3598.CVE-2022-3570.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff.patch";
+      sha256 = "sha256-SLq2+JaDEUOPZ5mY4GPB6uwhQOG5cD4qyL5o9i8CVVs=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libuninameslist/default.nix b/pkgs/development/libraries/libuninameslist/default.nix
index cd615ed81fe9..7915e7b50f6b 100644
--- a/pkgs/development/libraries/libuninameslist/default.nix
+++ b/pkgs/development/libraries/libuninameslist/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libuninameslist";
-  version = "20211114";
+  version = "20221022";
 
   src = fetchFromGitHub {
     owner = "fontforge";
     repo = pname;
     rev = version;
-    sha256 = "sha256-izxG2mx+D83s78eL19ERUaLrw9FPjlJRcFZw3+xzLDQ=";
+    sha256 = "sha256-YLlSe2++DpcptuAxLduTYAY2m9D8JSGDcvzijpAv1rU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libvorbis/default.nix b/pkgs/development/libraries/libvorbis/default.nix
index 281c7744a339..42e7328a8ec1 100644
--- a/pkgs/development/libraries/libvorbis/default.nix
+++ b/pkgs/development/libraries/libvorbis/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "1.3.7";
 
   src = fetchurl {
-    url = "http://downloads.xiph.org/releases/vorbis/${pname}-${version}.tar.xz";
+    url = "https://downloads.xiph.org/releases/vorbis/${pname}-${version}.tar.xz";
     sha256 = "0jwmf87x5sdis64rbv0l87mdpah1rbilkkxszipbzg128f9w8g5k";
   };
 
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # strip -mno-ieee-fp flag from configure and configure.ac when using
+  # clang as the flag is not recognized by the compiler
+  preConfigure = lib.optionalString (stdenv.cc.isClang or false) ''
+    sed s/\-mno\-ieee\-fp// -i {configure,configure.ac}
+  '';
+
   meta = with lib; {
     description = "Vorbis audio compression reference implementation";
     homepage = "https://xiph.org/vorbis/";
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index ae97292b6830..6e8936f7ce63 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -28,10 +28,10 @@ let
 in
   assert oldVer -> stdenv.isDarwin; # reduce likelihood of using old libxml2 unintentionally
 
-stdenv.mkDerivation rec {
+let
+libxml = stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = if oldVer then "2.10.1" else
-    "2.10.2";
+  version = "2.10.3";
 
   outputs = [ "bin" "dev" "out" "doc" ]
     ++ lib.optional pythonSupport "py"
@@ -39,9 +39,8 @@ stdenv.mkDerivation rec {
   outputMan = "bin";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = if oldVer then "21a9e13cc7c4717a6c36268d0924f92c3f67a1ece6b7ff9d588958a6db9fb9d8" else
-      "0kCr5tqcZcsZAN2b86NQHM+Is8Khy5gxfQPyct2lsmU=";
+    url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
+    sha256 = "XSzD14vsPb4hKp1/pimtolp9qSivQyyTBg/1wX7iipw=";
   };
 
   patches = [
@@ -145,4 +144,15 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ eelco jtojnar ];
   };
-}
+};
+in
+if oldVer then
+  libxml.overrideAttrs (attrs: rec {
+    version = "2.10.1";
+    src = fetchurl {
+      url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
+      sha256 = "21a9e13cc7c4717a6c36268d0924f92c3f67a1ece6b7ff9d588958a6db9fb9d8";
+    };
+  })
+else
+  libxml
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 0fbc3f0c2164..cf0451790707 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchpatch, buildPackages
+{ stdenv, lib, fetchurl
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
@@ -9,6 +9,7 @@
 , galliumDrivers ? ["auto"]
 , vulkanDrivers ? ["auto"]
 , eglPlatforms ? [ "x11" ] ++ lib.optionals stdenv.isLinux [ "wayland" ]
+, vulkanLayers ? [ "device-select" "overlay" ]
 , OpenGL, Xplugin
 , withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind-light && !valgrind-light.meta.broken, valgrind-light
 , enableGalliumNine ? stdenv.isLinux
@@ -35,7 +36,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "22.2.1";
+  version = "22.2.2";
   branch  = versions.major version;
 
 self = stdenv.mkDerivation {
@@ -50,7 +51,7 @@ self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "0079beac0a33f45e7e0aec59e6913eafbc4268a3f1e2e330017440494f91b13c";
+    sha256 = "2de11fb74fc5cc671b818e49fe203cea0cd1d8b69756e97cdb06a2f4e78948f9";
   };
 
   # TODO:
@@ -119,7 +120,8 @@ self = stdenv.mkDerivation {
     "-Dgallium-opencl=icd" # Enable the gallium OpenCL frontend
     "-Dclang-libdir=${llvmPackages.clang-unwrapped.lib}/lib"
   ] ++ optional enablePatentEncumberedCodecs
-    "-Dvideo-codecs=h264dec,h264enc,h265dec,h265enc,vc1dec";
+    "-Dvideo-codecs=h264dec,h264enc,h265dec,h265enc,vc1dec"
+  ++ optional (vulkanLayers != []) "-D vulkan-layers=${builtins.concatStringsSep "," vulkanLayers}";
 
   buildInputs = with xorg; [
     expat llvmPackages.libllvm libglvnd xorgproto
@@ -195,6 +197,11 @@ self = stdenv.mkDerivation {
     # move libOSMesa to $osmesa, as it's relatively big
     mkdir -p $osmesa/lib
     mv -t $osmesa/lib/ $out/lib/libOSMesa*
+  '' + lib.optionalString (vulkanLayers != []) ''
+    mv -t $drivers/lib $out/lib/libVkLayer*
+    for js in $drivers/share/vulkan/{im,ex}plicit_layer.d/*.json; do
+      substituteInPlace "$js" --replace '"libVkLayer_' '"'"$drivers/lib/libVkLayer_"
+    done
   '';
 
   postFixup = optionalString stdenv.isLinux ''
diff --git a/pkgs/development/libraries/neon/default.nix b/pkgs/development/libraries/neon/default.nix
index 4a00044bb557..827d7eb69799 100644
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@@ -3,6 +3,7 @@
 , sslSupport ? true, openssl ? null
 , static ? stdenv.hostPlatform.isStatic
 , shared ? !stdenv.hostPlatform.isStatic
+, bash
 }:
 
 assert compressionSupport -> zlib != null;
@@ -25,9 +26,11 @@ stdenv.mkDerivation rec {
   patches = optionals stdenv.isDarwin [ ./darwin-fix-configure.patch ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [libxml2 openssl]
+  buildInputs = [libxml2 openssl bash]
     ++ lib.optional compressionSupport zlib;
 
+  strictDeps = true;
+
   configureFlags = [
     (lib.enableFeature shared "shared")
     (lib.enableFeature static "static")
diff --git a/pkgs/development/libraries/nghttp3/default.nix b/pkgs/development/libraries/nghttp3/default.nix
index 1633de12e434..3638422bb0cd 100644
--- a/pkgs/development/libraries/nghttp3/default.nix
+++ b/pkgs/development/libraries/nghttp3/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nghttp3";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MZ5ynaGZTzO2w0hGHII19PFC0+kjfd+IlcsenGGgMgg=";
+    sha256 = "sha256-LSHhvRTzqpGJcyK3KoZZjbZVggXpgDEEVpp8gMoaE7U=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index e28a6c7b17c8..da0e535c1bc1 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nfXEX1GxtmOcb0reRyO0OyQkSHeUWtQW+SZ8thxor+s=";
+    sha256 = "sha256-zDiJlwcDTLCU+WpJ6Jz6tve4oV+XMRYOtppC2fj/HgU=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index b4a566030d07..2a3b25bc5827 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.79.1";
-  hash = "sha256-NwxS5niE0dnCG5d+lzPcwYzIR2WmsgGBT77VDCbfThQ=";
+  version = "3.79.2";
+  hash = "sha256-hwcHDI74CgYp2vhQyKspKQ6T/O55f6g/cZvb9z1np4E=";
 }
diff --git a/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch b/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
index baf162e88d09..04585565a331 100644
--- a/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
+++ b/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch
@@ -1,22 +1,25 @@
 diff --git a/Configure b/Configure
-index f0ad787bc4..a48d2008c6 100755
+index a558e5ab1a..9a884f0b0f 100755
 --- a/Configure
 +++ b/Configure
-@@ -1688,17 +1688,6 @@ unless ($disabled{devcryptoeng}) {
+@@ -1714,20 +1714,6 @@ unless ($disabled{devcryptoeng}) {
+ 
  unless ($disabled{ktls}) {
      $config{ktls}="";
-     if ($target =~ m/^linux/) {
--        my $usr = "/usr/$config{cross_compile_prefix}";
--        chop($usr);
--        if ($config{cross_compile_prefix} eq "") {
--            $usr = "/usr";
--        }
--        my $minver = (4 << 16) + (13 << 8) + 0;
--        my @verstr = split(" ",`cat $usr/include/linux/version.h | grep LINUX_VERSION_CODE`);
--
--        if ($verstr[2] < $minver) {
+-    my $cc = $config{CROSS_COMPILE}.$config{CC};
+-    if ($target =~ m/^linux/) {
+-        system("printf '#include <sys/types.h>\n#include <linux/tls.h>' | $cc -E - >/dev/null 2>&1");
+-        if ($? != 0) {
 -            disable('too-old-kernel', 'ktls');
 -        }
-     } elsif ($target =~ m/^BSD/) {
-         my $cc = $config{CROSS_COMPILE}.$config{CC};
-         system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1");
+-    } elsif ($target =~ m/^BSD/) {
+-        system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1");
+-        if ($? != 0) {
+-            disable('too-old-freebsd', 'ktls');
+-        }
+-    } else {
+-        disable('not-linux-or-freebsd', 'ktls');
+-    }
+ }
+ 
+ push @{$config{openssl_other_defines}}, "OPENSSL_NO_KTLS" if ($disabled{ktls});
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 78cc680c7be5..62cc8e24f417 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -130,7 +130,9 @@ let
       "-DUSE_CRYPTODEV_DIGESTS"
     ] ++ lib.optional enableSSL2 "enable-ssl2"
       ++ lib.optional enableSSL3 "enable-ssl3"
-      ++ lib.optional (lib.versionAtLeast version "3.0.0") "enable-ktls"
+      # We select KTLS here instead of the configure-time detection (which we patch out).
+      # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it.
+      ++ lib.optional (stdenv.isLinux && lib.versionAtLeast version "3.0.0") "enable-ktls"
       ++ lib.optional (lib.versionAtLeast version "1.1.1" && stdenv.hostPlatform.isAarch64) "no-afalgeng"
       # OpenSSL needs a specific `no-shared` configure flag.
       # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options
@@ -228,8 +230,8 @@ in {
   };
 
   openssl_3 = common {
-    version = "3.0.5";
-    sha256 = "sha256-qn2Nm+9xrWUlxVuhHl9Dl4ic5Jwsk0nc6m0+TwsCSno=";
+    version = "3.0.7";
+    sha256 = "sha256-gwSdBComDmlvYkBqxcCL9wb9hDg/lFzyG9YentlcOW4=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index b035df88e66d..32571d9e9abc 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -188,7 +188,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.freedesktop.org/wiki/Software/polkit";
     description = "A toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes";
     license = licenses.lgpl2Plus;
-    platforms = platforms.unix;
+    platforms = platforms.linux;
     maintainers = teams.freedesktop.members ++ (with maintainers; [ ]);
   };
 }
diff --git a/pkgs/development/libraries/protobuf/3.19.nix b/pkgs/development/libraries/protobuf/3.19.nix
index 8e8674f15041..c62e4d46ce8b 100644
--- a/pkgs/development/libraries/protobuf/3.19.nix
+++ b/pkgs/development/libraries/protobuf/3.19.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }:
 
 callPackage ./generic-v3.nix {
-  version = "3.19.5";
-  sha256 = "sha256-C5ZfPXHtUtNjPGS4tbswCwVH1gjd6A64KtIR16DgHzQ=";
+  version = "3.19.6";
+  sha256 = "sha256-+ul9F8tyrwk2p25Dd9ragqwpYzdxdeGjpXhLAwKYWfM=";
 }
diff --git a/pkgs/development/libraries/protobuf/3.20.nix b/pkgs/development/libraries/protobuf/3.20.nix
index d518e7298e9f..818e65639e57 100644
--- a/pkgs/development/libraries/protobuf/3.20.nix
+++ b/pkgs/development/libraries/protobuf/3.20.nix
@@ -1,6 +1,6 @@
 { callPackage, abseil-cpp, ... }:
 
 callPackage ./generic-v3.nix {
-  version = "3.20.2";
-  sha256 = "sha256-7hLTIujvYIGRqBQgPHrCq0XOh0GJrePBszXJnBFaXVM=";
+  version = "3.20.3";
+  sha256 = "sha256-u/1Yb8+mnDzc3OwirpGESuhjkuKPgqDAvlgo3uuzbbk=";
 }
diff --git a/pkgs/development/libraries/protobuf/3.21.nix b/pkgs/development/libraries/protobuf/3.21.nix
index c23afb9138f5..6ba9ca31aba6 100644
--- a/pkgs/development/libraries/protobuf/3.21.nix
+++ b/pkgs/development/libraries/protobuf/3.21.nix
@@ -1,6 +1,6 @@
 { callPackage, abseil-cpp, ... }:
 
 callPackage ./generic-v3-cmake.nix {
-  version = "3.21.6";
-  sha256 = "sha256-6Omd2O/eIZIgod3YV+zIIv+GqT+trith6+eepFEJIWM=";
+  version = "3.21.8";
+  sha256 = "sha256-cSNHX18CvMmydpYWqfe6WWk9rGxIlFfY/85rfSyznU4=";
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 033331c474ab..83f73c993072 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,207 +1,207 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "fe5fca853c09c7e03a2ff66dac21584e3307984d",
-    "sha256": "0z8vkr3a20sb428m5kizgj33fkrznqzhwc0mh1rdqivlcsfp4kfi"
+    "rev": "0ff905d194e273e04e95b72dbbfd4e58193ecbaa",
+    "sha256": "1jv4xjxdr6xbm4q8fk0ijhl845qnnhxqmwkzqg2ssxdn015iabj9"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "ccc9a61d10404a4999dec61fdb513aa50f265cc3",
-    "sha256": "1l4h721shvc5cy5n2ykj0bhi5bgn3c8w1dmiwxh45rnb6qz971da"
+    "rev": "80b43bfe4109820fb7feddb4a16e227a03bc1c4e",
+    "sha256": "1m3c0znrm63b2wbz7vghxrh22lxdp1s7bwc00qfwhgjn1ajyrp71"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "1d9324ce38ce5100d827942eda67fe634753655b",
-    "sha256": "1k00pibnadgjnvv42kfq5pynr0gljv35hri6k5gfswqw347dr6f8"
+    "rev": "3f8c9f144acbe921a759d261e1314614793f89e0",
+    "sha256": "1k680n1gvj55i0yb7zrlbai4w3mvhhcbbpmcgm1wlv29rg268gi4"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "e44097b63d17ba3178a637df7fac51ddc51cb48b",
-    "sha256": "071q48qnszwqkmdpf14nqzbyqs62apfjhm0640fggv5ydgrbqw6j"
+    "rev": "98c727f273fc83c24550274bd2728e1aafbd213a",
+    "sha256": "1hwswan0yw6l4rka60ch173sd71ijx0y15gb2hnd3mhzws8gjsb5"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "841083c263f16f8acb81e4915bf24bbed0461c9a",
-    "sha256": "1iic9q8qj6bz6qznfr0jdjdi3a72lb433d0k711cfz2np2i8ajz1"
+    "rev": "055c6d6e49c5ea369990e7078fd534392a0ba6b9",
+    "sha256": "0r07yjdlxzk34br905da5kcm6xda50907nrffkw99683ix9y64ag"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "01e8b04b121712ea0a2b2793ce13f4dd5e9cfcf8",
-    "sha256": "1mgm4dpsw7k79znw0h72h614i0lvivvbp8w67np2nqp411wghgaa"
+    "rev": "6796953f92a1d3af30d0676e56ec5dfd82199611",
+    "sha256": "16zh10rm2b4sk9mn4r4sfp2mzvrxlz4nqj8bpiy055mplz5day39"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "502612c72a2cd3b3b0c4cff926e7764d74106d33",
-    "sha256": "0g9y0gi78v256zv70dl3fbpwr4ihs2i99pis3x4m3br5w1p7lknq"
+    "rev": "8e1a57efa1ba3eabbf44098ce6ede3d130c57b5d",
+    "sha256": "19v7la492414d0qzqdqnbhpxpg0hsqll6ixhv4jrckvdaqv7iqxz"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "b3aaf1482c48bbc0ca4f7c7934597c055afe4b6a",
-    "sha256": "12ia5zr7ajlfxjsdc4qhwjcyyc7vwr4ihs244v40y8ym2p0hm02l"
+    "rev": "45d43c04088efb8346979f633f72bb1f23183461",
+    "sha256": "1ad6r1zwzzvl1i2rxkjgp8x5k4ahcf6grfq6xarbbj9qvvb08ny4"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "032bc4f434e1a914dfc29651533d491160d06add",
-    "sha256": "1r2az30pv2kvj6hif6ngmc8b2nf0rwv2rgss5mf9ks85kglvmy51"
+    "rev": "e3e926a66f0a4ffbf82f0df1a5f570d759faad4f",
+    "sha256": "1ji5qn9bhyz30z12dvh97xxi3ga9b4lymdc7kmzmcd37y56q9s5c"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "0a2d4651362810600d2ff7272772d5908bb8714b",
-    "sha256": "1qzfyarc910rg308lydaniwbr49a6wl0hwh74a5w223bl9qqi5mj"
+    "rev": "ce0202d67bf1ab2bb887f58122b20eab5b6c1d5d",
+    "sha256": "11c24b2pzjcv14xix96fghyx3j3kw6rmhh499wqwc0qy5mjb6kpw"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "e6e1e58ec28fd0f2e6426e6962cc4ccddb493349",
-    "sha256": "1780flyc57bvicvgp071590kmhgm4nfrfys2b0adbmnkwb3fm3ij"
+    "rev": "a2b1600300cda89804d48ec90e0068a075fecc8b",
+    "sha256": "0ca666260mvvlf551076840pvh9r67v2bhmf0yf1xp06rxc205zq"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "9044695f4b1acdd7ec24e7b01f6a6ca61f982a75",
-    "sha256": "1rzshk2s4prglwcvr2wfr7qk0m3x3gq0d2wk741ifl7gb5nidsd5"
+    "rev": "1b83a9c73d6e5459ec4c2221b2bd7e5396b5e874",
+    "sha256": "07ry1bfim24aa530xslp8njn1bzalrmrwcx0xz2p2jilhfvvp5fc"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "ebdf5b38da6e3fe0a183702bcca395c589c459ed",
-    "sha256": "17igx94c3qx0ahpnkpxip4db4413q3hcr19hcs0j4wc03vkcmafr"
+    "rev": "f920a6cc2931402023840c223fce2fed321e28ea",
+    "sha256": "08r6h5d120x6lnzrjwscvv1dbjf720mg508wkyf8f999xncmp0yi"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "d40b67401afe7156b03c62c9a4d517b07555fe64",
-    "sha256": "1w9qcx7aczkf03qwm2jzjlj9k0qb8j0x4lfrj4lw7pwggb16f6p0"
+    "rev": "8bb9237e4e1462f405d931a8a513ed4c27632d9e",
+    "sha256": "1qd86wrvf3487s3f39m6pvcipa5s7zhn99kbfnmrhg0q35cr2816"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "c9bf2516187331033f0860976497eab0828cf25e",
-    "sha256": "0242gbj3rmkx4s1jzrb3kz07pl06xcfy0aqyb5xanzkg4sllrsaw"
+    "rev": "e7d4c37810976b6a1730d842cbca04b66ca7de30",
+    "sha256": "01kxc4185kb3pq2dfcjyl3n765gjwpf9l2r4q6gncy5v75a2y700"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "76f84c545429a1b988b79f971734ef4bc3e6643f",
-    "sha256": "1i1ca3n9i1rwpsxda2xm9ap3ys7a5jazbgzcwnwjb4qsxvjss6gz"
+    "rev": "f3dc18968c437c993886d3bfb668b62344a10860",
+    "sha256": "0li29bvvjcck1y4zhhc6imxa8ip3988yv2zz5k6anyasb0ywbip8"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "01315e31c5164c896a524175854c4b6df17fe166",
-    "sha256": "03vpynmkcb58x13mxjsjl07kh3jymcf295z5vybssqimyijlfw0m"
+    "rev": "f34ac77b5955126be60faa2b801be2d19dff896f",
+    "sha256": "1ip0sp70q4mircngs77p2m8njh8aw6f1q1w6f7nm0i2vkydpqfy2"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "fa07915d5b7c5ba16f2e8ba32a9066fe7eed0cb1",
-    "sha256": "1khpg9dfd0bgmqffzi4f2sgm8hnwzq9fqfg32y857mbc85f346bv"
+    "rev": "25ead89b0834f669e0a193e6d6cf2da25d33a452",
+    "sha256": "1jx44zr8kpjjg92by6sb9p5nqkadsqdhprngdbzyvxzhh1bplg1h"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "5cf67a0a93026ffd41d2ea5a11b289f46a518376",
-    "sha256": "13yjb9y69by7jqw7l2qvmpi8835x7j0vxcy2slkjjw2msrj0mq2y"
+    "rev": "95f52cb212f66e6022661fb7f2eb81a8c21e9f22",
+    "sha256": "0j508pc4fyz7gi9bjmyq4i0q9kmfhcckgwp38wcvgr6xm83f224n"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "e62b8b6d2f45a79652238b33f4bbe23023004ae7",
-    "sha256": "0598ckgkmqayq0c4c5fq6fyi098m74249qvz98m61bkk5629s24c"
+    "rev": "c7dae5f6041d6c076311f2d8ed13fcfe3598be70",
+    "sha256": "1fxvhrikjywh7gbz4lyivkvmsfnlqb7sd7r5rzqg6xi61x7i3fm4"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "74e8db97fdb9b55c4b4614b83f4bf17e00df55e9",
-    "sha256": "1f8hjsy3qyljyrpdjvwgq6a6ixlxyz3xjn32irzxx9vfxlp54wxf"
+    "rev": "9ff77702cc3649cbaf94046742d682d77cdea698",
+    "sha256": "0sq2j94csmd7ifd1hw4lwv7b82l59iz2258jg50d0j5hcf3acydz"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "87ad61716a7cba5a070d8a7b1756c8b2b48d5d53",
-    "sha256": "02rhr3qk2k3g8ydv7w3pkkk4vdlq0jbmsbp78k1difadsxhnw563"
+    "rev": "e2438e010a98d731317c10a64c095e0282b51ab0",
+    "sha256": "0bbj0blxz3zbz03a85drwysshl0qib0fl46ln22ll52819qw111v"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "aa705010da0f658b78c1155babce7091ae44529a",
-    "sha256": "1lkrxjk11qwanr7l84hqxlgk9y4shgznnxhlmfkp61ysnqladilx"
+    "rev": "5f2a598a9134167a0da2efcbf1249fc167ae3750",
+    "sha256": "1c3cg8fq681wrqk2xhajym1l9f8vfsffc8g0xp06m7lp11hr9bmq"
   },
   "qtscript": {
     "url": "https://invent.kde.org/qt/qt/qtscript.git",
-    "rev": "197f10dad6213ec4bb2e1a8305f19ec7475a6266",
-    "sha256": "1hksdl3ran5nv0q0idrdq78nk2qqmszq911fgxwfhifqakdqxyvp"
+    "rev": "b169b3e6ac1f9d66834ad61fbe35d3e25ff204bc",
+    "sha256": "01nfg53ixlggam5id16n1lc9n2anclrk6prvawi2fhpcnw4dpdza"
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "631fd7bcc34802b7650c2b1dc73691463954d982",
-    "sha256": "17r19f5s2lmj6avic2sx2hm1xlcl3gnnmigvjla6gc1wr71wbgaw"
+    "rev": "e1faea1db52b91d90ef64dd57eb6529e323b5526",
+    "sha256": "1j1ckm2jca0h8zyfyq3kzf0dwp8jw9xwlpg7f7qi5dd8wd9dncmi"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "35eb5ac7eaef4745a38958c3ca780d7baa2e4f30",
-    "sha256": "0c6p495rmfw741xp8vfjxkac3d144id0gjccgshp8xh4syld52q9"
+    "rev": "5f1f73fdba8906f58c4554cbef9c1a72edcf0230",
+    "sha256": "0y7zyx9br4scbgkja5smkmyhlb6snqhir8mypsgdc4kllnbr4wkh"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "f9f7eee60adac72fcf6617d164e3bf61222bb5c5",
-    "sha256": "1ixnagxhxd54y9kn27jmhgb41zg5dzxywvai3gg7jh0v7gxr8pxp"
+    "rev": "180cb13048a24510f9a1b20796772d27da762bdd",
+    "sha256": "1s7y7rdicb50aa2kfsl74y0dm1qd2kd6fncyqaq55w0rn95fks87"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "c9abfcd5d88cb43c2a7c1d5ddecbff4cdd320694",
-    "sha256": "180ypj7k36c64vgq5028hxh22vfc9bk8s4vczc1dzri8sw8pnpmm"
+    "rev": "966cf2a2077a8470715894363ad46ea7df0665fa",
+    "sha256": "1a3f3fhwblifgsn3x6qhx4fmpxp458q4x8vp3jdxmynnkfiigafp"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "d1273416f25a15a6edf6ea56a07602cd7d99fe48",
-    "sha256": "00ikp6zv96g253msfrcvxavpyw9lv2ia5pjsysmxb4vikrk7j8vr"
+    "rev": "d32f4a479d38a11f547598004b975f4356424a16",
+    "sha256": "1n0f2pym6kl0fh5iqrln7z45hwmw8bha5s7bzswsihrq6zxkca4f"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "a9752b00a03438de8e5b080073816e12409404b7",
-    "sha256": "1m3bg2xb1sa0r3dv5jljk8hsj3gw71qqzk9bsa7j2jn50inb2fh5"
+    "rev": "83296f10ebdb9a666b11dc69f3a148c38b9c425c",
+    "sha256": "0gifl43lnddp0shbyhmijlm2qpqj6fp2xip96nxn1ql3g70f9kyv"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "32912a06aadfc3dcbc34e0a668ce2c78351eee6e",
-    "sha256": "096gdp349n94d9y5zy9k3k1xrf5g7lbla3j1cm4dala8rrnachg5"
+    "rev": "c4750dd02070ce246ff98cc5d137193825043912",
+    "sha256": "0zryql6g77hdqsh10gzmw9n8ibki35b5jvh96gjl29yrvan9w5v7"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "d4db9d8a4893a70e7ba3a6d5fe62f24f9ce745ca",
-    "sha256": "0srprryw0fr13d3wqpdjbcc9n6mcq1cwsdd5mdilqr7bz375qz8d"
+    "rev": "c38edd3a5501bcd53132e1e4abb7d25a98e0e1a9",
+    "sha256": "0if1mx6jic67pzv1p0xqb5fknfbawvzxw7fx90hc4kkrwjm73q7m"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "9fbb837b55887bec5d73fad142c853ef68db35b3",
-    "sha256": "12769162183qyxgr5p1bx2p2wlnkqg3fgz86ya9g4iznx0nagx19"
+    "rev": "8aebadb96c1e57ba89bba2e5962399f676207a32",
+    "sha256": "0hygidp8l580d10c1g6pgdxd3g6lza0dkgfm6bd2kjrigg71fzh0"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "8faf74a7966b520f0ac3eb4d88235f8ec63b31b8",
-    "sha256": "1khbpg9wds1gg6z7nj58hflzhy2gjaiy3v6pa930hb1r8sisp154"
+    "rev": "9c607c771acdb3d820be7f112db99213a6c6d7eb",
+    "sha256": "1dbilhkldvhwwd2j0g7mwz1jyw9zgzwyyx43rsmnmv9lh36pb3dc"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "fb1ca87aa1a12048199d2aabe9015b7222d2b773",
-    "sha256": "1rsx3zf0xnvayanxwpr5yniiyw2a8bwifhrkw2gzdczdyasxdfw7"
+    "rev": "4e35fe9429920067c17596986b486fb1c1e95db0",
+    "sha256": "1j74hfrrrb1irchlgqclbk3zjgg98clndfw576psa3zm8xg3szin"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "68a322c391c2eb92876fce42b9fc23ad2f3a1ecb",
-    "sha256": "0rd1zr39nckqlxmmgxf4zhkrh8vb3098z33ajsizz9ld5ylwkyw7"
+    "rev": "3087cdd0758258163299602550f7d4e72edf2a80",
+    "sha256": "19gsc842njdgmiqhkl7xqqry1d40phjwixzajzphv4s5vmcbxn5w"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "a066371747a7eb9de9b1ae38fbc41b2059080802",
-    "sha256": "0cjy399xx15z2y00bvh7jn8m8wjpx65gwg4gwrn3r2zpdw8aqqrb"
+    "rev": "594477769ecac4032ba116196493f3ba3db1aaed",
+    "sha256": "102r5jam8kc46bjlxf3jdjsr1jzdj5vfwmf4yypbhihwz436z791"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "87577dde04ed219bda776dabca86176149736331",
-    "sha256": "070s9ml8ixbmd7a7b49mnc0fya4wy3mx174n50acb99mmi7ar6z3"
+    "rev": "b1605fea61a6bbb599b720c54282bc8ddb0aacf0",
+    "sha256": "158hiqrshblw3axpryv0lqk74691njdc8qmdxbz28hzaaq6rxj5n"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "a2ef397d1833c7417138a14ae23c880ae434d8a6",
-    "sha256": "1jqx03wwklqak8sjjlgmi55r2l07ylsfdar1j9kb0zn1krh7d9mw"
+    "rev": "2a04b162451460ffc208c2c27acce16a18f763ce",
+    "sha256": "17h5bd94jhwqgzlb5w75rfgb3v0jkg6fm79kd0byzp7bvp7i7ibj"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "982f20eb585d77e5b5c721e05a466d7161f7f2d1",
-    "sha256": "0zl4bdxvdx2kfjwkd0rxvh70580g6idrgj4m3pyyw7z2jbzawpv3"
+    "rev": "9134cdba9386e408ce2ffe515ca0c3f6f6c66685",
+    "sha256": "03qs1griqx3bccaqas8mifbj4f4bhwfzc3f6knws3zy3mc9l8qzq"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "30e6c84fe2752cde8b53aff9d38c2095cd7c8761",
-    "sha256": "04i1282hyqqspdlvny1dz5006svq84rpqvnvlvsas83vxzhr1g1k"
+    "rev": "b798a0f0265538a9dd12b5c7e4dad84ba8e1db4e",
+    "sha256": "1lh9rci7bqrjw912blns369qs76c7lywnxmmmlhchrhk9l89ailk"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index ef625a7c763d..35d8eae1abb3 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -1,7 +1,7 @@
 { lib, fetchgit, fetchFromGitHub }:
 
 let
-  version = "5.15.6";
+  version = "5.15.7";
   overrides = {};
 
   mk = name: args:
diff --git a/pkgs/development/libraries/quictls/default.nix b/pkgs/development/libraries/quictls/default.nix
index 22981bfef7af..cd0ae4d3eef4 100644
--- a/pkgs/development/libraries/quictls/default.nix
+++ b/pkgs/development/libraries/quictls/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "quictls";
-  version = "3.0.5+quick_unstable-2022-07.05";
+  version = "3.0.7+quic1";
 
   src = fetchFromGitHub {
     owner = "quictls";
     repo = "openssl";
-    rev = "75e940831d0570d6b020cfebf128ae500f424867";
-    sha256 = "sha256-1HBGKafcCbM0RZWLvyl3vpSfGBsAcGDgjz1Nm/qclWM=";
+    rev = "openssl-${version}";
+    sha256 = "sha256-ZRS0ZV+/U4PD2lVE+PsUAWSuk5EFg5mOKYlwgY3Ecus=";
   };
 
   patches = [
@@ -108,6 +108,9 @@ stdenv.mkDerivation rec {
     "-DUSE_CRYPTODEV_DIGESTS"
   ] ++ lib.optional enableSSL2 "enable-ssl2"
     ++ lib.optional enableSSL3 "enable-ssl3"
+    # We select KTLS here instead of the configure-time detection (which we patch out).
+    # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it.
+    ++ lib.optional (stdenv.isLinux && lib.versionAtLeast version "3.0.0") "enable-ktls"
     ++ lib.optional stdenv.hostPlatform.isAarch64 "no-afalgeng"
     # OpenSSL needs a specific `no-shared` configure flag.
     # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index 2e163a79d596..857da102bb8c 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -1,16 +1,13 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, nix-update-script
-
-# for passthru.tests
-, bazel
+, cmake
+, ninja
 , chromium
 , grpc
 , haskellPackages
 , mercurial
-, ninja
-, python3
+, python3Packages
 }:
 
 stdenv.mkDerivation rec {
@@ -21,48 +18,54 @@ stdenv.mkDerivation rec {
     owner = "google";
     repo = "re2";
     rev = version;
-    sha256 = "sha256-UontAjOXpnPcOgoFHjf+1WSbCR7h58/U7nn4meT200Y=";
+    hash = "sha256-UontAjOXpnPcOgoFHjf+1WSbCR7h58/U7nn4meT200Y=";
   };
 
-  preConfigure = ''
-    substituteInPlace Makefile --replace "/usr/local" "$out"
-    # we're using gnu sed, even on darwin
-    substituteInPlace Makefile  --replace "SED_INPLACE=sed -i '''" "SED_INPLACE=sed -i"
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ cmake ninja ];
+
+  postPatch = ''
+    substituteInPlace re2Config.cmake.in \
+      --replace "\''${PACKAGE_PREFIX_DIR}/" ""
   '';
 
-  buildFlags = lib.optionals stdenv.hostPlatform.isStatic [ "static" ];
+  # Needed for case-insensitive filesystems (i.e. MacOS) because a file named
+  # BUILD already exists.
+  cmakeBuildDir = "build_dir";
 
-  enableParallelBuilding = true;
+  cmakeFlags = lib.optional (!stdenv.hostPlatform.isStatic) "-DBUILD_SHARED_LIBS:BOOL=ON";
+
+  # This installs a pkg-config definition.
+  postInstall = ''
+    pushd "$src"
+    make common-install prefix="$dev" SED_INPLACE="sed -i"
+    popd
+  '';
 
-  preCheck = "patchShebangs runtests";
   doCheck = true;
-  checkTarget = if stdenv.hostPlatform.isStatic then "static-test" else "test";
 
-  installTargets = lib.optionals stdenv.hostPlatform.isStatic [ "static-install" ];
-
-  doInstallCheck = true;
-  installCheckTarget = if stdenv.hostPlatform.isStatic then "static-testinstall" else "testinstall";
-
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = pname;
-    };
-    tests = {
-      inherit
-        chromium
-        grpc
-        mercurial;
-      inherit (python3.pkgs)
-        fb-re2
-        google-re2;
-      haskellPackages-re2 = haskellPackages.re2;
-    };
+  passthru.tests = {
+    inherit
+      chromium
+      grpc
+      mercurial;
+    inherit (python3Packages)
+      fb-re2
+      google-re2;
+    haskell-re2 = haskellPackages.re2;
   };
 
-  meta = {
+  meta = with lib; {
+    description = "A regular expression library";
+    longDescription = ''
+      RE2 is a fast, safe, thread-friendly alternative to backtracking regular
+      expression engines like those used in PCRE, Perl, and Python. It is a C++
+      library.
+    '';
+    license = licenses.bsd3;
     homepage = "https://github.com/google/re2";
-    description = "An efficient, principled regular expression library";
-    license = lib.licenses.bsd3;
-    platforms = with lib.platforms; all;
+    maintainers = with maintainers; [ azahi ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index de135e9168ac..d1c854f0cfb2 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "sdk-${version}";
-    hash = "sha256-qYhFoRrQOlvYvVXhIFsa3dZuORDpZyVC5peeYmGNimw=";
+    hash = "sha256-lUWgZYGPu+IaLUrbtyC7R0o3Hq/q7C7BE8r7DAsiC30=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index d27d2bf008cf..47cdccf41fc1 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "sdk-${version}";
-    hash = "sha256-zUT5+Ttmkrj51a9FS1tQxoYMS0Y0xV8uaCEJNur4khc=";
+    hash = "sha256-EoD48jBoJmIet4BDC6bYxOsKK2358SZ/NcZeM61q/5g=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 0c3e48289cbc..27c1423d94e5 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,14 +3,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-Loader";
       rev = "sdk-${version}";
-      hash = "sha256-lmdImPeosHbAbEzPVW4K9Wkz/mF6gr8MVroGf0bDEPc=";
+      hash = "sha256-HWaa3JT0znhvqbvZdcsAwy8Dr6HDQp4rgpVmMOuCo0s=";
     });
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index 5fca71ebf0c1..34b5d4ff3c6e 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wayland-protocols";
-  version = "1.26";
+  version = "1.27";
 
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 
   src = fetchurl {
-    url = "https://wayland.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "04vgllmpmrv14x3x64ns01vgwx4hriljayjkz9idgbv83i63hly5";
+    url = "https://gitlab.freedesktop.org/wayland/${pname}/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
+    hash = "sha256-kEbxCkJdTioAlloDrPtrP7V1pWUDrHLCuGghxpZTN1w=";
   };
 
   postPatch = lib.optionalString doCheck ''
diff --git a/pkgs/development/libraries/x265/default.nix b/pkgs/development/libraries/x265/default.nix
index 3bf11737eb3c..b4a7777b8911 100644
--- a/pkgs/development/libraries/x265/default.nix
+++ b/pkgs/development/libraries/x265/default.nix
@@ -25,6 +25,8 @@
 let
   mkFlag = optSet: flag: if optSet then "-D${flag}=ON" else "-D${flag}=OFF";
 
+  isCross = stdenv.buildPlatform != stdenv.hostPlatform;
+
   cmakeCommonFlags = [
     "-Wno-dev"
     (mkFlag custatsSupport "DETAILED_CU_STATS")
@@ -81,6 +83,8 @@ stdenv.mkDerivation rec {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/x265/files/test-ns.patch?id=1d1de341e1404a46b15ae3e84bc400d474cf1a2c";
       sha256 = "0zg3g53l07yh7ar5c241x50y5zp7g8nh8rh63ad4bdpchpc2f52d";
     })
+    # Fix detection of NEON (and armv6 build) :
+    ./fix-neon-detection.patch
   ];
 
   postPatch = ''
@@ -107,7 +111,7 @@ stdenv.mkDerivation rec {
     "-DENABLE_SHARED=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
     "-DHIGH_BIT_DEPTH=OFF"
     "-DENABLE_HDR10_PLUS=ON"
-  ] ++ [
+    (mkFlag (isCross && stdenv.hostPlatform.isAarch) "CROSS_COMPILE_ARM")
     (mkFlag cliSupport "ENABLE_CLI")
     (mkFlag unittestsSupport "ENABLE_TESTS")
   ] ++ lib.optionals (multibitdepthSupport) [
diff --git a/pkgs/development/libraries/x265/fix-neon-detection.patch b/pkgs/development/libraries/x265/fix-neon-detection.patch
new file mode 100644
index 000000000000..dbb826e54668
--- /dev/null
+++ b/pkgs/development/libraries/x265/fix-neon-detection.patch
@@ -0,0 +1,28 @@
+commit 72489cd0a1c229258abe4f20e4fdfd414dfa88da
+Author: rnhmjoj <rnhmjoj@inventati.org>
+Date:   Sun Oct 2 00:15:24 2022 +0200
+
+    Fix NEON detection
+
+diff --git a/cmake/FindNeon.cmake b/cmake/FindNeon.cmake
+index 0062449..9c436d9 100644
+--- a/cmake/FindNeon.cmake
++++ b/cmake/FindNeon.cmake
+@@ -1,10 +1,11 @@
+ include(FindPackageHandleStandardArgs)
+ 
+ # Check the version of neon supported by the ARM CPU
+-execute_process(COMMAND cat /proc/cpuinfo | grep Features | grep neon
+-                OUTPUT_VARIABLE neon_version
+-                ERROR_QUIET
+-                OUTPUT_STRIP_TRAILING_WHITESPACE)
+-if(neon_version)
+-    set(CPU_HAS_NEON 1)
++message(STATUS "Detecting NEON support")
++execute_process(COMMAND sed -n "/Features.* neon/q 1" /proc/cpuinfo
++                RESULT_VARIABLE CPU_HAS_NEON)
++if(CPU_HAS_NEON)
++    message(STATUS "Detecting NEON support - supported")
++else()
++    message(STATUS "Detecting NEON support - not supported" )
+ endif()
diff --git a/pkgs/development/libraries/zlib/CVE-2022-37434.patch b/pkgs/development/libraries/zlib/CVE-2022-37434.patch
deleted file mode 100644
index ad2a849d3b89..000000000000
--- a/pkgs/development/libraries/zlib/CVE-2022-37434.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001
-From: Mark Adler <fork@madler.net>
-Date: Sat, 30 Jul 2022 15:51:11 -0700
-Subject: [PATCH] Fix a bug when getting a gzip header extra field with
- inflate().
-
-If the extra field was larger than the space the user provided with
-inflateGetHeader(), and if multiple calls of inflate() delivered
-the extra header data, then there could be a buffer overflow of the
-provided space. This commit assures that provided space is not
-exceeded.
----
- inflate.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/inflate.c b/inflate.c
-index 7be8c6366..7a7289749 100644
---- a/inflate.c
-+++ b/inflate.c
-@@ -763,9 +763,10 @@ int flush;
-                 copy = state->length;
-                 if (copy > have) copy = have;
-                 if (copy) {
-+                    len = state->head->extra_len - state->length;
-                     if (state->head != Z_NULL &&
--                        state->head->extra != Z_NULL) {
--                        len = state->head->extra_len - state->length;
-+                        state->head->extra != Z_NULL &&
-+                        len < state->head->extra_max) {
-                         zmemcpy(state->head->extra + len, next,
-                                 len + copy > state->head->extra_max ?
-                                 state->head->extra_max - len : copy);
-
-From 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d Mon Sep 17 00:00:00 2001
-From: Mark Adler <fork@madler.net>
-Date: Mon, 8 Aug 2022 10:50:09 -0700
-Subject: [PATCH] Fix extra field processing bug that dereferences NULL
- state->head.
-
-The recent commit to fix a gzip header extra field processing bug
-introduced the new bug fixed here.
----
- inflate.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/inflate.c b/inflate.c
-index 7a7289749..2a3c4fe98 100644
---- a/inflate.c
-+++ b/inflate.c
-@@ -763,10 +763,10 @@ int flush;
-                 copy = state->length;
-                 if (copy > have) copy = have;
-                 if (copy) {
--                    len = state->head->extra_len - state->length;
-                     if (state->head != Z_NULL &&
-                         state->head->extra != Z_NULL &&
--                        len < state->head->extra_max) {
-+                        (len = state->head->extra_len - state->length) <
-+                            state->head->extra_max) {
-                         zmemcpy(state->head->extra + len, next,
-                                 len + copy > state->head->extra_max ?
-                                 state->head->extra_max - len : copy);
diff --git a/pkgs/development/libraries/zlib/comprehensive-crc-validation-for-wrong-implementations.patch b/pkgs/development/libraries/zlib/comprehensive-crc-validation-for-wrong-implementations.patch
deleted file mode 100644
index 85a6a7e3ab41..000000000000
--- a/pkgs/development/libraries/zlib/comprehensive-crc-validation-for-wrong-implementations.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From ec3df00224d4b396e2ac6586ab5d25f673caa4c2 Mon Sep 17 00:00:00 2001
-From: Mark Adler <madler@alumni.caltech.edu>
-Date: Wed, 30 Mar 2022 11:14:53 -0700
-Subject: [PATCH] Correct incorrect inputs provided to the CRC functions.
-
-The previous releases of zlib were not sensitive to incorrect CRC
-inputs with bits set above the low 32. This commit restores that
-behavior, so that applications with such bugs will continue to
-operate as before.
----
- crc32.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/crc32.c b/crc32.c
-index a1bdce5c2..451887bc7 100644
---- a/crc32.c
-+++ b/crc32.c
-@@ -630,7 +630,7 @@ unsigned long ZEXPORT crc32_z(crc, buf, len)
- #endif /* DYNAMIC_CRC_TABLE */
- 
-     /* Pre-condition the CRC */
--    crc ^= 0xffffffff;
-+    crc = (~crc) & 0xffffffff;
- 
-     /* Compute the CRC up to a word boundary. */
-     while (len && ((z_size_t)buf & 7) != 0) {
-@@ -749,7 +749,7 @@ unsigned long ZEXPORT crc32_z(crc, buf, len)
- #endif /* DYNAMIC_CRC_TABLE */
- 
-     /* Pre-condition the CRC */
--    crc ^= 0xffffffff;
-+    crc = (~crc) & 0xffffffff;
- 
- #ifdef W
- 
-@@ -1077,7 +1077,7 @@ uLong ZEXPORT crc32_combine64(crc1, crc2, len2)
- #ifdef DYNAMIC_CRC_TABLE
-     once(&made, make_crc_table);
- #endif /* DYNAMIC_CRC_TABLE */
--    return multmodp(x2nmodp(len2, 3), crc1) ^ crc2;
-+    return multmodp(x2nmodp(len2, 3), crc1) ^ (crc2 & 0xffffffff);
- }
- 
- /* ========================================================================= */
-@@ -1112,5 +1112,5 @@ uLong crc32_combine_op(crc1, crc2, op)
-     uLong crc2;
-     uLong op;
- {
--    return multmodp(op, crc1) ^ crc2;
-+    return multmodp(op, crc1) ^ (crc2 & 0xffffffff);
- }
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index a51fec31c14a..52654b6541e3 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -21,16 +21,18 @@ assert shared || static;
 
 assert splitStaticOutput -> static;
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
   pname = "zlib";
-  version = "1.2.12";
+  version = "1.2.13";
 
   src = fetchurl {
-    urls =
-      [ "https://www.zlib.net/fossils/zlib-${version}.tar.gz"  # stable archive path
-        "mirror://sourceforge/libpng/zlib/${version}/zlib-${version}.tar.gz"
-      ];
-    sha256 = "91844808532e5ce316b3c010929493c0244f3d37593afd6de04f71821d5136d9";
+    urls = [
+      # This URL works for 1.2.13 only; hopefully also for future releases.
+      "https://github.com/madler/zlib/releases/download/v${version}/zlib-${version}.tar.gz"
+      # Stable archive path, but captcha can be encountered, causing hash mismatch.
+      "https://www.zlib.net/fossils/zlib-${version}.tar.gz"
+    ];
+    hash = "sha256-s6JN6XqP28g1uYMxaVAQMLiXcDG8tUs7OsE3QPhGqzA=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -40,23 +42,18 @@ stdenv.mkDerivation (rec {
       --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
   '';
 
-  patches = [
-    ./fix-configure-issue-cross.patch
-    # Starting zlib 1.2.12, zlib is stricter to incorrect CRC inputs
-    # with bits set above the low 32.
-    # see https://github.com/madler/zlib/issues/618
-    # TODO: remove the patch if upstream releases https://github.com/madler/zlib/commit/ec3df00224d4b396e2ac6586ab5d25f673caa4c2
-    # see https://github.com/NixOS/nixpkgs/issues/170539 for history.
-    ./comprehensive-crc-validation-for-wrong-implementations.patch
-    ./CVE-2022-37434.patch
-  ];
-
   strictDeps = true;
   outputs = [ "out" "dev" ]
     ++ lib.optional splitStaticOutput "static";
   setOutputFlags = false;
   outputDoc = "dev"; # single tiny man3 page
 
+  dontConfigure = stdenv.hostPlatform.libc == "msvcrt";
+
+  preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    export CHOST=${stdenv.hostPlatform.config}
+  '';
+
   # For zlib's ./configure (as of verion 1.2.11), the order
   # of --static/--shared flags matters!
   # `--shared --static` builds only static libs, while
@@ -128,20 +125,10 @@ stdenv.mkDerivation (rec {
     "SHARED_MODE=1"
   ];
 
-  passthru = {
-    inherit version;
-  };
-
   meta = with lib; {
     homepage = "https://zlib.net";
     description = "Lossless data-compression library";
     license = licenses.zlib;
     platforms = platforms.all;
   };
-} // lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
-  preConfigure = ''
-    export CHOST=${stdenv.hostPlatform.config}
-  '';
-} // lib.optionalAttrs (stdenv.hostPlatform.libc == "msvcrt") {
-  dontConfigure = true;
-})
+}
diff --git a/pkgs/development/libraries/zlib/fix-configure-issue-cross.patch b/pkgs/development/libraries/zlib/fix-configure-issue-cross.patch
deleted file mode 100644
index 0136071eabe7..000000000000
--- a/pkgs/development/libraries/zlib/fix-configure-issue-cross.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 05796d3d8d5546cf1b4dfe2cd72ab746afae505d Mon Sep 17 00:00:00 2001
-From: Mark Adler <madler@alumni.caltech.edu>
-Date: Mon, 28 Mar 2022 18:34:10 -0700
-Subject: [PATCH] Fix configure issue that discarded provided CC definition.
-
----
- configure | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/configure b/configure
-index 52ff4a04e..3fa3e8618 100755
---- a/configure
-+++ b/configure
-@@ -174,7 +174,10 @@ if test -z "$CC"; then
-   else
-     cc=${CROSS_PREFIX}cc
-   fi
-+else
-+  cc=${CC}
- fi
-+
- cflags=${CFLAGS-"-O3"}
- # to force the asm version use: CFLAGS="-O3 -DASMV" ./configure
- case "$cc" in
diff --git a/pkgs/development/python-modules/colorama/default.nix b/pkgs/development/python-modules/colorama/default.nix
index 76f9063ab9a4..1ae46cb2be79 100644
--- a/pkgs/development/python-modules/colorama/default.nix
+++ b/pkgs/development/python-modules/colorama/default.nix
@@ -1,24 +1,26 @@
-{ lib, fetchPypi, buildPythonPackage }:
+{ lib, fetchPypi, buildPythonPackage, hatchling, pytestCheckHook }:
 
 buildPythonPackage rec {
   pname = "colorama";
-  version = "0.4.5";
+  version = "0.4.6";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-5sa0M0/FCYimOdm5iqQpoLV9puF7mkTwRR+TC2lnt6Q=";
+    sha256 = "08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44";
   };
 
-  # No tests in archive
-  doCheck = false;
+  nativeBuildInputs = [ hatchling ];
+
+  checkInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "colorama" ];
 
   meta = with lib; {
     description = "Cross-platform colored terminal text";
     homepage = "https://github.com/tartley/colorama";
+    changelog = "https://github.com/tartley/colorama/raw/${version}/CHANGELOG.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
   };
 }
-
diff --git a/pkgs/development/python-modules/dateparser/default.nix b/pkgs/development/python-modules/dateparser/default.nix
index 5c151d518bb9..79a45bdb3575 100644
--- a/pkgs/development/python-modules/dateparser/default.nix
+++ b/pkgs/development/python-modules/dateparser/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , isPy3k
 , fetchFromGitHub
+, fetchpatch
 , python-dateutil
 , pytz
 , regex
@@ -31,17 +32,17 @@ buildPythonPackage rec {
 
   patches = [
     ./regex-compat.patch
+    (fetchpatch {
+      name = "tests-31st.patch";
+      url = "https://github.com/scrapinghub/dateparser/commit/b132381b9c15e560a0be5183c7d96180119a7b4f.diff";
+      sha256 = "nQUWtfku5sxx/C45KJnfwvDXiccXGeVM+cQDKX9lxbE=";
+    })
   ];
 
   postPatch = ''
     substituteInPlace setup.py --replace \
       'regex !=2019.02.19,!=2021.8.27,<2022.3.15' \
       'regex'
-
-    # https://github.com/scrapinghub/dateparser/issues/1053
-    substituteInPlace tests/test_search.py --replace \
-      "('June 2020', datetime.datetime(2020, 6, datetime.datetime.utcnow().day, 0, 0))," \
-      "('June 2020', datetime.datetime(2020, 6, min(30, datetime.datetime.utcnow().day), 0, 0)),"
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/frozenlist/default.nix b/pkgs/development/python-modules/frozenlist/default.nix
index 1bc295fbe332..73a5bfdb73fc 100644
--- a/pkgs/development/python-modules/frozenlist/default.nix
+++ b/pkgs/development/python-modules/frozenlist/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "frozenlist";
-  version = "1.3.0";
+  version = "1.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cHKqkvsBUN7If+8swbd6aafFrSgnop3YlweBLPOHzyU=";
+    hash = "sha256-nOzS004uduS5C8y4ig0IaYyfk+h94uTiN048X66HO+Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 77ac855e1f6f..0f659c0a14e2 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -9,16 +9,21 @@
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.48.1";
+  version = "1.50.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "655af4d0d6e67586cb2ca24c3db5fe08e4e2972d17f295f6b546fa7bd7eef1f6";
+    sha256 = "69be81c4317ec77983fb0eab80221a01e86e833e0fcf2f6acea0a62597c84b93";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'protobuf>=4.21.6' 'protobuf'
+  '';
+
   propagatedBuildInputs = [
     googleapis-common-protos
     grpcio
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index d386deb44221..1fbdc3973799 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,16 +2,16 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.48.1";
+  version = "1.50.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1178f2ea531f80cc2027ec64728df6ffc8e98cf1df61652a496eafd612127183";
+    sha256 = "88b75f2afd889c7c6939f58d76b58ab84de4723c7de882a1f8448af6632e256f";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-    --replace 'protobuf>=3.12.0, < 4.0dev' 'protobuf'
+      --replace 'protobuf>=4.21.6,<5.0dev' 'protobuf'
   '';
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index 0ad6cabd9515..486742ccb605 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -1,6 +1,5 @@
 { lib, stdenv
 , buildPythonPackage
-, fetchpatch
 , grpc
 , six
 , protobuf
@@ -17,15 +16,7 @@
 buildPythonPackage rec {
   inherit (grpc) src version;
   pname = "grpcio";
-
-  patches = [
-    # Fix build on armv6l
-    # https://github.com/grpc/grpc/pull/30401
-    (fetchpatch {
-      url = "https://github.com/grpc/grpc/commit/65dc9f3edeee4c2d0e9b30d5a3ee63175437bea3.patch";
-      hash = "sha256-pS4FsCcSjmjSs3J5Y96UonkxqPwfpkyhrEM0t6HaMd0=";
-    })
-  ];
+  format = "setuptools";
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/python-modules/mdurl/default.nix b/pkgs/development/python-modules/mdurl/default.nix
index da44a1dbbc3d..fb846dffd158 100644
--- a/pkgs/development/python-modules/mdurl/default.nix
+++ b/pkgs/development/python-modules/mdurl/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "mdurl";
-  version = "0.1.1";
+  version = "0.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "hukkin";
     repo = pname;
     rev = version;
-    sha256 = "sha256-SBJSs+i+I0jF90i3o6BUgLCDR6Et34fXEmQ7fbDoAbA=";
+    sha256 = "sha256-wxV8DKeTwKpFTUBuGTQXaVHc0eW1//Y+2V8Kgs85TDM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index ee1d0bbffb5a..cc7ea3c7bdc3 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -1,41 +1,14 @@
 { buildPackages
 , lib
-, fetchpatch
-, python
 , buildPythonPackage
-, isPy37
 , protobuf
-, google-apputils ? null
-, six
 , pyext
-, isPy27
-, disabled
-, doCheck ? true
+, isPyPy
 }:
 
 buildPythonPackage {
   inherit (protobuf) pname src version;
-  inherit disabled;
-  doCheck = doCheck && !isPy27; # setuptools>=41.4 no longer collects correctly on python2
-
-  propagatedBuildInputs = [ six ] ++ lib.optionals isPy27 [ google-apputils ];
-  propagatedNativeBuildInputs = let
-    protobufVersion = "${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}";
-  in [
-    buildPackages."protobuf${protobufVersion}" # For protoc of the same version.
-  ];
-
-  nativeBuildInputs = [ pyext ] ++ lib.optionals isPy27 [ google-apputils ];
-  buildInputs = [ protobuf ];
-
-  patches = lib.optional (isPy37 && (lib.versionOlder protobuf.version "3.6.1.2"))
-    # Python 3.7 compatibility (not needed for protobuf >= 3.6.1.2)
-    (fetchpatch {
-      url = "https://github.com/protocolbuffers/protobuf/commit/0a59054c30e4f0ba10f10acfc1d7f3814c63e1a7.patch";
-      sha256 = "09hw22y3423v8bbmc9xm07znwdxfbya6rp78d4zqw6fisdvjkqf1";
-      stripLen = 1;
-    })
-  ;
+  disabled = isPyPy;
 
   prePatch = ''
     while [ ! -d python ]; do
@@ -44,21 +17,30 @@ buildPythonPackage {
     cd python
   '';
 
-  setupPyGlobalFlags = lib.optional (lib.versionAtLeast protobuf.version "2.6.0")
-    "--cpp_implementation";
+  nativeBuildInputs = [ pyext ];
+
+  buildInputs = [ protobuf ];
+
+  propagatedNativeBuildInputs = [
+    # For protoc of the same version.
+    buildPackages."protobuf${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}"
+  ];
+
+  setupPyGlobalFlags = "--cpp_implementation";
 
   pythonImportsCheck = [
     "google.protobuf"
-  ] ++ lib.optionals (lib.versionAtLeast protobuf.version "2.6.0") [
     "google.protobuf.internal._api_implementation" # Verify that --cpp_implementation worked
   ];
 
+  passthru = {
+    inherit protobuf;
+  };
+
   meta = with lib; {
     description = "Protocol Buffers are Google's data interchange format";
     homepage = "https://developers.google.com/protocol-buffers/";
     license = licenses.bsd3;
     maintainers = with maintainers; [ knedlsepp ];
   };
-
-  passthru.protobuf = protobuf;
 }
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 4b13f996e954..7c842352eb02 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -39,7 +39,7 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.4.41";
+  version = "1.4.41"; # TODO: check python3Packages.fastapi when updating to >= 1.4.42
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index 78a428a2a724..6d96df91c4f5 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , aiofiles
 , anyio
 , contextlib2
@@ -33,6 +34,14 @@ buildPythonPackage rec {
     hash = "sha256-vP2TJPn9lRGnLGkO8lUmnsoT6rSnhuWDD3WqNk76SM0=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/encode/starlette/commit/ab70211f0e1fb7390668bf4891eeceda8d9723a0.diff";
+      excludes = [ "requirements.txt" ]; # conflicts
+      hash = "sha256-UHf4c4YUWp/1I1vD8J0hMewdlfkmluA+FyGf9ZsSv3Y=";
+    })
+  ];
+
   postPatch = ''
     # remove coverage arguments to pytest
     sed -i '/--cov/d' setup.cfg
diff --git a/pkgs/development/python-modules/watchdog/default.nix b/pkgs/development/python-modules/watchdog/default.nix
index d77f0d5db1f0..f38b732f9ebb 100644
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@@ -8,6 +8,7 @@
 , pytest-timeout
 , pytestCheckHook
 , CoreServices
+, fetchpatch
 }:
 
 buildPythonPackage rec {
@@ -22,6 +23,12 @@ buildPythonPackage rec {
 
   patches = lib.optionals (stdenv.isDarwin && !stdenv.isAarch64) [
     ./force-kqueue.patch
+  ] ++ [
+    (fetchpatch {
+      url = "https://github.com/gorakhargosh/watchdog/commit/255d1e45c17929dd5ba8a6f91aa28771109931cd.patch";
+      sha256 = "sha256-gGgEGuB/0g+4Pv1dXMvIdObjqKruWKkxtufS/dzSlY8=";
+      excludes = [ "changelog.rst" ];
+    })
   ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
@@ -41,11 +48,6 @@ buildPythonPackage rec {
     substituteInPlace setup.cfg \
       --replace "--cov=watchdog" "" \
       --replace "--cov-report=term-missing" ""
-  '' + lib.optionalString stdenv.hostPlatform.isMusl
-  # https://github.com/gorakhargosh/watchdog/issues/920
-  ''
-    substituteInPlace tests/test_inotify_c.py \
-      --replace "Unknown error -1" "No error information"
   '';
 
   disabledTests = [
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 13848a602dcf..9d2edcb749c5 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.3.23";
-  source.sha256 = "sha256-xYrUhtzNfN3X9r8GqGj9d1aeZkcPozFrk/2c9oVkKx8=";
+  version = "2.3.24";
+  source.sha256 = "sha256-6qLrjDiS6HD5eSUrIZa9d+tVHh2/PNxOsWS6AexEOMQ=";
   dontPatchShebangs = true;
 
   passthru.updateScript = writeScript "gem-update-script" ''
diff --git a/pkgs/development/tools/build-managers/bear/default.nix b/pkgs/development/tools/build-managers/bear/default.nix
index 50474c2a522b..e7255d6e756b 100644
--- a/pkgs/development/tools/build-managers/bear/default.nix
+++ b/pkgs/development/tools/build-managers/bear/default.nix
@@ -9,7 +9,6 @@
 , gtest
 , spdlog
 , c-ares
-, abseil-cpp
 , zlib
 , sqlite
 , re2
@@ -36,7 +35,6 @@ stdenv.mkDerivation rec {
     gtest
     spdlog
     c-ares
-    abseil-cpp
     zlib
     sqlite
     re2
diff --git a/pkgs/development/tools/documentation/gtk-doc/default.nix b/pkgs/development/tools/documentation/gtk-doc/default.nix
index 5951c8d71fd5..18d53e51da43 100644
--- a/pkgs/development/tools/documentation/gtk-doc/default.nix
+++ b/pkgs/development/tools/documentation/gtk-doc/default.nix
@@ -32,6 +32,11 @@ python3.pkgs.buildPythonApplication rec {
     passthru.respect_xml_catalog_files_var_patch
   ];
 
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace "pkg-config" "$PKG_CONFIG"
+  '';
+
   strictDeps = true;
 
   depsBuildBuild = [
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 6b5c2ba42f8d..4486636a9f50 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -90,6 +90,7 @@ stdenv.mkDerivation rec {
     # subset of the platform description.
     "--program-prefix=${targetPrefix}"
 
+    "--disable-werror"
     "--enable-targets=all" "--enable-64-bit-bfd"
     "--disable-install-libbfd"
     "--disable-shared" "--enable-static"
diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 327fed92d46f..2ac91924feba 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   src = (assert version == spirv-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "SPIRV-Tools";
       rev = "sdk-${version}";
-      hash = "sha256-jpVvjrNrTAKUY4sjUT/gCUElLtW4BrznH1DbStojGB8=";
+      hash = "sha256-sqjQoz9v9alSPc0ujEcWZxDAWh2S6oAPP1+JZmNCpA0=";
     }
   );
 
diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index 0484ee47b88e..4f6a766e5e96 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -22,7 +22,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   # If we were to use "dev" here instead of headers, the setupHook would be
   # placed in that output instead of "out".
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
       owner = "KhronosGroup";
       repo = "Vulkan-ValidationLayers";
       rev = "sdk-${version}";
-      hash = "sha256-5To5Llxl1i1XLaU2tR/O7g7dn2iV3FwLH7gFdXTMXxo=";
+      hash = "sha256-5bzUauu8081zyRaWmRUtOxHjUU4gc1GWoJtU783Msh0=";
     });
 
   # Include absolute paths to layer libraries in their associated
diff --git a/pkgs/development/web/nodejs/disable-darwin-v8-system-instrumentation-node19.patch b/pkgs/development/web/nodejs/disable-darwin-v8-system-instrumentation-node19.patch
new file mode 100644
index 000000000000..5d56af784973
--- /dev/null
+++ b/pkgs/development/web/nodejs/disable-darwin-v8-system-instrumentation-node19.patch
@@ -0,0 +1,16 @@
+Disable v8 system instrumentation on Darwin
+
+On Darwin, the v8 system instrumentation requires the header "os/signpost.h"
+which is available since apple_sdk 11+. See: https://github.com/nodejs/node/issues/39584
+
+--- old/tools/v8_gypfiles/features.gypi
++++ new/tools/v8_gypfiles/features.gypi
+@@ -62,7 +62,7 @@
+       }, {
+         'is_component_build': 0,
+       }],
+-      ['OS == "win" or OS == "mac"', {
++      ['OS == "win"', {
+         # Sets -DENABLE_SYSTEM_INSTRUMENTATION. Enables OS-dependent event tracing
+         'v8_enable_system_instrumentation': 1,
+       }, {
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 6d9a3392a7a9..27bc3edb276f 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -67,7 +67,7 @@ let
     configureFlags = let
       isCross = stdenv.hostPlatform != stdenv.buildPlatform;
       inherit (stdenv.hostPlatform) gcc isAarch32;
-    in sharedConfigureFlags ++ [
+    in sharedConfigureFlags ++ optionals (versionOlder version "19") [
       "--without-dtrace"
     ] ++ (optionals isCross [
       "--cross-compiling"
diff --git a/pkgs/development/web/nodejs/v16.nix b/pkgs/development/web/nodejs/v16.nix
index 5e0ea0a996cc..a0586849cf75 100644
--- a/pkgs/development/web/nodejs/v16.nix
+++ b/pkgs/development/web/nodejs/v16.nix
@@ -8,18 +8,10 @@ let
 in
   buildNodejs {
     inherit enableNpm;
-    version = "16.17.1";
-    sha256 = "sha256-ZyH+tBUtVtLGs1jOOXq9Wn8drwnuLiXFAhubTT+GozA=";
+    version = "16.18.0";
+    sha256 = "sha256-/P5q0jQPIpBh0+galN8Wf+P3fgFxLe3AFEoOfVjixps=";
     patches = [
       ./disable-darwin-v8-system-instrumentation.patch
       ./bypass-darwin-xcrun-node16.patch
-      # Fix npm silently fail without a HOME directory https://github.com/npm/cli/issues/4996
-      (fetchpatch {
-        url = "https://github.com/npm/cli/commit/9905d0e24c162c3f6cc006fa86b4c9d0205a4c6f.patch";
-        sha256 = "sha256-RlabXWtjzTZ5OgrGf4pFkolonvTDIPlzPY1QcYDd28E=";
-        includes = [ "deps/npm/lib/npm.js" "deps/npm/lib/utils/log-file.js" ];
-        stripLen = 1;
-        extraPrefix = "deps/npm/";
-      })
     ];
   }
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index 9cb626a93d98..142bf08bad7e 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -8,8 +8,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "18.10.0";
-  sha256 = "17z8081bqsldx4dl7399dp9gdsmd04lgnwvwycj7sjmyw9a1nwdd";
+  version = "18.12.0";
+  sha256 = "sha256-c6fwHimZ6xl3Y87WZqbNVErVgOrvtz4KhJYDs+gE9C4=";
   patches = [
     (fetchpatch {
       # Fixes cross compilation to aarch64-linux by reverting https://github.com/nodejs/node/pull/43200
diff --git a/pkgs/development/web/nodejs/v19.nix b/pkgs/development/web/nodejs/v19.nix
new file mode 100644
index 000000000000..cb34e1c919d8
--- /dev/null
+++ b/pkgs/development/web/nodejs/v19.nix
@@ -0,0 +1,25 @@
+{ callPackage, openssl, fetchpatch, python3, enableNpm ? true }:
+
+let
+  buildNodejs = callPackage ./nodejs.nix {
+    inherit openssl;
+    python = python3;
+  };
+in
+buildNodejs {
+  inherit enableNpm;
+  version = "19.0.0";
+  sha256 = "sha256-C3LSB6WBXxznskezPL+aLIb20BJT+jmQyXROJdl1BQ0=";
+  patches = [
+    (fetchpatch {
+      # Fixes cross compilation to aarch64-linux by reverting https://github.com/nodejs/node/pull/43200
+      name = "revert-arm64-pointer-auth.patch";
+      url = "https://github.com/nodejs/node/pull/43200/commits/d42c42cc8ac652ab387aa93205aed6ece8a5040a.patch";
+      sha256 = "sha256-ipGzg4lEoftTJbt6sW+0QJO/AZqHvUkFKe0qlum+iLY=";
+      revert = true;
+    })
+
+    ./disable-darwin-v8-system-instrumentation-node19.patch
+    ./bypass-darwin-xcrun-node16.patch
+  ];
+}
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index c30833937be8..89a04bacd770 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -70,6 +70,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ gmp ];
 
+  configurePlatforms = [ "build" "host" ];
   configureFlags = [
     "--localstatedir=/var"
     "--sysconfdir=/etc"
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index bf6014056eda..4fb1e83917ae 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -78,6 +78,7 @@ let
       INTEL_RAPL                       = whenAtLeast "5.3" module;
       X86_INTEL_LPSS                   = yes;
       X86_INTEL_PSTATE                 = yes;
+      X86_AMD_PSTATE                   = whenAtLeast "5.17" module;
     };
 
     external-firmware = {
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 056544014f42..5a4c2858f95f 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -137,7 +137,7 @@ let
     makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
       ++ extraMakeFlags;
 
-    prePatch = kernel.prePatch + ''
+    postPatch = kernel.postPatch + ''
       # Patch kconfig to print "###" after every question so that
       # generate-config.pl from the generic builder can answer them.
       sed -e '/fflush(stdout);/i\printf("###");' -i scripts/kconfig/conf.c
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 1049d1c62a9f..f9aa18801042 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -105,7 +105,7 @@ let
         # Fixes determinism by normalizing metadata for the archive of kheaders
         ++ optional (lib.versionAtLeast version "5.2" && lib.versionOlder version "5.4") ./gen-kheaders-metadata.patch;
 
-      prePatch = ''
+      postPatch = ''
         sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
 
         # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
@@ -118,14 +118,9 @@ let
         # See also https://kernelnewbies.org/BuildId
         sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
 
-        # Some linux-hardened patches now remove certain files in the scripts directory, so we cannot
-        # patch all scripts until after patches are applied.
-        # However, scripts/ld-version.sh is still ran when generating a configfile for a kernel, so it needs
-        # to be patched prior to patchPhase
-        patchShebangs scripts/ld-version.sh
-      '';
+        # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
+        [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
 
-      postPatch = ''
         # Set randstruct seed to a deterministic but diversified value. Note:
         # we could have instead patched gen-random-seed.sh to take input from
         # the buildFlags, but that would require also patching the kernel's
@@ -135,7 +130,7 @@ let
           if [ -f "$file" ]; then
             substituteInPlace "$file" \
               --replace NIXOS_RANDSTRUCT_SEED \
-              $(echo ${randstructSeed}${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
+              $(echo ${randstructSeed}${src} ${placeholder "configfile"} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
             break
           fi
         done
diff --git a/pkgs/os-specific/linux/libaio/default.nix b/pkgs/os-specific/linux/libaio/default.nix
index 046bba5dda0f..fe2e69e06fd7 100644
--- a/pkgs/os-specific/linux/libaio/default.nix
+++ b/pkgs/os-specific/linux/libaio/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
-  version = "0.3.112";
+  version = "0.3.113";
   pname = "libaio";
 
   src = fetchurl {
     url = "https://pagure.io/libaio/archive/${pname}-${version}/${pname}-${pname}-${version}.tar.gz";
-    sha256 = "0wi2myh191sja13qj3claxhpfkngvy10x30f78hm9cxzkfr97kxp";
+    sha256 = "sha256-cWxwWXAyRzROsGa1TsvDyiE08BAzBxkubCt9q1+VKKs=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 9ccebdff2e06..5e5a758f302a 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -85,7 +85,7 @@
 , withHostnamed ? true
 , withHwdb ? true
 , withImportd ? !stdenv.hostPlatform.isMusl
-, withLibBPF ? true
+, withLibBPF ? lib.versionAtLeast llvmPackages.clang.version "10.0"
 , withLocaled ? true
 , withLogind ? true
 , withMachined ? true
diff --git a/pkgs/servers/rippled/default.nix b/pkgs/servers/rippled/default.nix
index 55b082f99484..d781f92d45e9 100644
--- a/pkgs/servers/rippled/default.nix
+++ b/pkgs/servers/rippled/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit, fetchurl, git, cmake, pkg-config
-, openssl, boost, grpc, abseil-cpp, protobuf, libnsl }:
+, openssl, boost, grpc, protobuf, libnsl }:
 
 let
   sqlite3 = fetchurl rec {
@@ -130,7 +130,7 @@ in stdenv.mkDerivation rec {
   cmakeFlags = ["-Dstatic=OFF" "-DBoost_NO_BOOST_CMAKE=ON"];
 
   nativeBuildInputs = [ pkg-config cmake git ];
-  buildInputs = [ openssl openssl.dev boostSharedStatic grpc abseil-cpp protobuf libnsl ];
+  buildInputs = [ openssl openssl.dev boostSharedStatic grpc protobuf libnsl ];
 
   preConfigure = ''
     export HOME=$PWD
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 3c07316e45c1..34fd3e45906f 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -7,14 +7,6 @@
 let
   py = python3.override {
     packageOverrides = self: super: {
-      # TODO: https://github.com/aws/aws-cli/pull/5712
-      colorama = super.colorama.overridePythonAttrs (oldAttrs: rec {
-        version = "0.4.3";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "189n8hpijy14jfan4ha9f5n06mnl33cxz7ay92wjqgkr639s0vg9";
-        };
-      });
       pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
         version = "5.4.1";
         src = fetchFromGitHub {
@@ -47,6 +39,7 @@ with py.pkgs; buildPythonApplication rec {
   postPatch = ''
     substituteInPlace setup.py \
       --replace "docutils>=0.10,<0.17" "docutils>=0.10" \
+      --replace "colorama>=0.2.5,<0.4.5" "colorama>=0.2.5,<0.5" \
       --replace "rsa>=3.1.2,<4.8" "rsa<5,>=3.1.2"
   '';
 
diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index 104167c6d721..aaf42193ce7d 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -30,23 +30,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "graphviz";
-  version = "5.0.1";
+  version = "7.0.0";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     rev = version;
-    sha256 = "sha256-lcU6Pb45kg7AxXQ9lmqwAazT2JpGjBz4PzK+S5lpYa0=";
+    sha256 = "sha256-n+g4XNTSbCXOoL7JIE6uP9AZJj3YDfTG9EcmUA+r8hY=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://gitlab.com/graphviz/graphviz/-/commit/8d662734b6a34709d9475b120e7ce3de872339e2.diff";
-      includes = [ "lib/*" ];
-      sha256 = "sha256-cqzUpK//2TnzWb7oSa/g8LJ61yr3O+Wiq5LsZzw34NE=";
-    })
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index 22943bc12862..6a8056dfe41d 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-ExtensionLayer";
       rev = "sdk-${version}";
-      hash = "sha256-KOlwtfuAYWzUFtf0NOJCNzWW+/ogRUgkaWw8NdW2vb8=";
+      hash = "sha256-8Z9w+3WFPYp8QKEUVkEQCGy9LXMWYlZDgGt8i34T5DU=";
     });
 
   nativeBuildInputs = [ cmake jq ];
@@ -21,6 +21,11 @@ stdenv.mkDerivation rec {
     export XDG_DATA_DIRS=@out@/share:$XDG_DATA_DIRS
   '';
 
+  # Tests are not for gpu-less and headless environments
+  cmakeFlags = [
+    "-DBUILD_TESTS=false"
+  ];
+
   # Include absolute paths to layer libraries in their associated
   # layer definition json files.
   preFixup = ''
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index 4c39671ffac3..5a7e7fd85238 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -23,14 +23,14 @@
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
   # The version must match that in vulkan-headers
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "LunarG";
       repo = "VulkanTools";
       rev = "sdk-${version}";
-      hash = "sha256-YQv6YboyQJjLTEKspZQdV8YFhHux/4RIncHXOsz1cBw=";
+      hash = "sha256-qomhouuKVv4Dat9Sv7X68Dw6bRnaUjj6iEXC9pCqX4E=";
       fetchSubmodules = true;
     });
 
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index f57cba28439e..cb3fb8456a8d 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -21,17 +21,17 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.3.224.1";
+  version = "1.3.231.0";
 
   # It's not strictly necessary to have matching versions here, however
   # since we're using the SDK version we may as well be consistent with
   # the rest of nixpkgs.
-  src = (assert version == vulkan-headers.version;
+  src = (assert (version) == vulkan-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-Tools";
       rev = "sdk-${version}";
-      hash = "sha256-Z+QJBd2LBdiJD1fHhBLbOfOoLhqTg0J3tq+XQRSiQaY=";
+      hash = "sha256-6oimP4ISa0dX4bLU3Nch8Ur6MzEMQscnL8EfRrqT/Es=";
     });
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch b/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
index eddc282dd87b..3be4c273b3b3 100644
--- a/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
+++ b/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
@@ -31,9 +31,9 @@ index 99048c489..19abfbbac 100644
 --- a/lib/curl_setup.h
 +++ b/lib/curl_setup.h
 @@ -247,19 +247,6 @@
- #  include "setup-win32.h"
- #endif
- 
+
+ #include <curl/system.h>
+
 -/*
 - * Use getaddrinfo to resolve the IPv4 address literal. If the current network
 - * interface doesn't support IPv4, but supports IPv6, NAT64, and DNS64,
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 32d2fbb62de0..6d5f28e7a82f 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -47,14 +47,14 @@ assert !(opensslSupport && wolfsslSupport);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "7.85.0";
+  version = "7.86.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.bz2"
       "https://github.com/curl/curl/releases/download/curl-${finalAttrs.version}/curl-${finalAttrs.version}.tar.bz2"
     ];
-    sha256 = "sha256-IafoNijulhZKwrNv9r+Z1GfHsLYhwffjF9jw2WARU5w=";
+    sha256 = "sha256-9cpp2wPuoX+ocFvfsan1jXakbJAQUYEJuzjzExN+Cig=";
   };
 
   patches = [
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index e5f26bca5612..a4ade683b136 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -10,10 +10,12 @@
 , polkit
 , systemdMinimal
 , IOKit
+, pname ? "pcsclite"
+, polkitSupport ? false
 }:
 
 stdenv.mkDerivation rec {
-  pname = "pcsclite";
+  inherit pname;
   version = "1.9.5";
 
   outputs = [ "bin" "out" "dev" "doc" "man" ];
@@ -34,14 +36,12 @@ stdenv.mkDerivation rec {
     "--enable-confdir=/etc"
     # The OS should care on preparing the drivers into this location
     "--enable-usbdropdir=/var/lib/pcsc/drivers"
-  ]
-  ++ (if stdenv.isLinux then [
+    (lib.enableFeature stdenv.isLinux "systemd")
+    (lib.enableFeature polkitSupport "polkit")
+  ] ++ lib.optionals stdenv.isLinux [
     "--enable-ipcdir=/run/pcscd"
-    "--enable-polkit"
     "--with-systemdsystemunitdir=${placeholder "bin"}/lib/systemd/system"
-  ] else [
-    "--disable-libsystemd"
-  ]);
+  ];
 
   postConfigure = ''
     sed -i -re '/^#define *PCSCLITE_HP_DROPDIR */ {
@@ -59,8 +59,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config perl ];
 
   buildInputs = [ python3 ]
-    ++ lib.optionals stdenv.isLinux [ dbus polkit systemdMinimal ]
-    ++ lib.optionals stdenv.isDarwin [ IOKit ];
+    ++ lib.optionals stdenv.isLinux [ systemdMinimal ]
+    ++ lib.optionals stdenv.isDarwin [ IOKit ]
+    ++ lib.optionals polkitSupport [ dbus polkit ];
 
   meta = with lib; {
     description = "Middleware to access a smart card using SCard API (PC/SC)";
diff --git a/pkgs/tools/typesetting/asciidoctor-with-extensions/Gemfile.lock b/pkgs/tools/typesetting/asciidoctor-with-extensions/Gemfile.lock
index 5b0e79aa2bd5..0ebae362b7e9 100644
--- a/pkgs/tools/typesetting/asciidoctor-with-extensions/Gemfile.lock
+++ b/pkgs/tools/typesetting/asciidoctor-with-extensions/Gemfile.lock
@@ -2,23 +2,23 @@ GEM
   remote: https://rubygems.org/
   specs:
     Ascii85 (1.1.0)
-    addressable (2.8.0)
-      public_suffix (>= 2.0.2, < 5.0)
+    addressable (2.8.1)
+      public_suffix (>= 2.0.2, < 6.0)
     afm (0.2.2)
-    asciidoctor (2.0.17)
+    asciidoctor (2.0.18)
     asciidoctor-bibtex (0.8.0)
       asciidoctor (~> 2.0)
       bibtex-ruby (~> 5.1)
       citeproc-ruby (~> 1)
       csl-styles (~> 1)
       latex-decode (~> 0.2)
-    asciidoctor-diagram (2.2.1)
+    asciidoctor-diagram (2.2.3)
       asciidoctor (>= 1.5.7, < 3.x)
       asciidoctor-diagram-ditaamini (~> 1.0)
       asciidoctor-diagram-plantuml (~> 1.2021)
       rexml
-    asciidoctor-diagram-ditaamini (1.0.1)
-    asciidoctor-diagram-plantuml (1.2021.8)
+    asciidoctor-diagram-ditaamini (1.0.3)
+    asciidoctor-diagram-plantuml (1.2022.5)
     asciidoctor-epub3 (1.5.1)
       asciidoctor (>= 1.5.6, < 3.0.0)
       gepub (~> 1.0.0)
@@ -30,17 +30,17 @@ GEM
       asciidoctor (~> 2.0)
       asciimath (~> 2.0)
       mathematical (~> 1.6.0)
-    asciidoctor-multipage (0.0.15)
+    asciidoctor-multipage (0.0.16)
       asciidoctor (>= 2.0.11, < 2.1)
-    asciidoctor-pdf (1.6.2)
+    asciidoctor-pdf (2.3.2)
       asciidoctor (~> 2.0)
       concurrent-ruby (~> 1.1)
+      matrix (~> 0.4)
       prawn (~> 2.4.0)
       prawn-icon (~> 3.0.0)
       prawn-svg (~> 0.32.0)
       prawn-table (~> 0.2.0)
       prawn-templates (~> 0.1.0)
-      safe_yaml (~> 1.0.0)
       treetop (~> 1.6.0)
     asciidoctor-revealjs (4.1.0)
       asciidoctor (>= 2.0.0, < 3.0.0)
@@ -49,7 +49,7 @@ GEM
     asciidoctor-rouge (0.4.0)
       asciidoctor (>= 1.5.6, < 2.1)
       rouge (>= 2.2, < 4)
-    asciimath (2.0.3)
+    asciimath (2.0.4)
     bibtex-ruby (5.1.6)
       latex-decode (~> 0.0)
     citeproc (1.0.10)
@@ -58,33 +58,34 @@ GEM
       citeproc (~> 1.0, >= 1.0.9)
       csl (~> 1.6)
     coderay (1.1.3)
-    concurrent-ruby (1.1.9)
+    concurrent-ruby (1.1.10)
     csl (1.6.0)
       namae (~> 1.0)
       rexml
     csl-styles (1.0.1.11)
       csl (~> 1.0)
-    css_parser (1.11.0)
+    css_parser (1.12.0)
       addressable
     gepub (1.0.15)
       nokogiri (>= 1.8.2, < 2.0)
       rubyzip (> 1.1.1, < 2.4)
     hashery (2.1.2)
-    i18n (1.8.11)
+    i18n (1.12.0)
       concurrent-ruby (~> 1.0)
-    latex-decode (0.3.2)
+    latex-decode (0.4.0)
     mathematical (1.6.14)
       ruby-enum (~> 0.4)
+    matrix (0.4.2)
     mime-types (3.4.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2022.0105)
-    mini_portile2 (2.7.1)
+    mini_portile2 (2.8.0)
     namae (1.1.1)
-    nokogiri (1.13.1)
-      mini_portile2 (~> 2.7.0)
+    nokogiri (1.13.8)
+      mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     pdf-core (0.9.0)
-    pdf-reader (2.8.0)
+    pdf-reader (2.10.0)
       Ascii85 (~> 1.0)
       afm (~> 0.2.1)
       hashery (~> 2.0)
@@ -105,16 +106,15 @@ GEM
     prawn-templates (0.1.2)
       pdf-reader (~> 2.0)
       prawn (~> 2.2)
-    public_suffix (4.0.6)
+    public_suffix (5.0.0)
     pygments.rb (2.3.0)
     racc (1.6.0)
     rexml (3.2.5)
-    rouge (3.27.0)
+    rouge (3.30.0)
     ruby-enum (0.9.0)
       i18n
     ruby-rc4 (0.1.5)
     rubyzip (2.3.2)
-    safe_yaml (1.0.5)
     thread_safe (0.3.6)
     treetop (1.6.11)
       polyglot (~> 0.3)
@@ -139,4 +139,4 @@ DEPENDENCIES
   rouge
 
 BUNDLED WITH
-   2.2.24
+   2.3.22
diff --git a/pkgs/tools/typesetting/asciidoctor-with-extensions/gemset.nix b/pkgs/tools/typesetting/asciidoctor-with-extensions/gemset.nix
index 498653c12f2e..4404a01e137a 100644
--- a/pkgs/tools/typesetting/asciidoctor-with-extensions/gemset.nix
+++ b/pkgs/tools/typesetting/asciidoctor-with-extensions/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "022r3m9wdxljpbya69y2i3h9g3dhhfaqzidf95m6qjzms792jvgp";
+      sha256 = "1ypdmpdn20hxp5vwxz3zc04r5xcwqc25qszdlg41h8ghdqbllwmw";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.8.1";
   };
   afm = {
     groups = ["default"];
@@ -35,10 +35,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g8gn3g6qy4bzjv1b14sj283kqynjgwq62bgq569jr4dkqwmwnzd";
+      sha256 = "11z3vnd8vh3ny1vx69bjrbck5b2g8zsbj94npyadpn7fdp8y3ldv";
       type = "gem";
     };
-    version = "2.0.17";
+    version = "2.0.18";
   };
   asciidoctor-bibtex = {
     dependencies = ["asciidoctor" "bibtex-ruby" "citeproc-ruby" "csl-styles" "latex-decode"];
@@ -57,30 +57,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1z1ilpczjaydhcwpz3yygn03yrx2ljjj55xczwkrlb8rzgh03br3";
+      sha256 = "1jzaahnnyarjn24vvgprkisij5nw5mzqjphgycxf11gpmnvs2lar";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "2.2.3";
   };
   asciidoctor-diagram-ditaamini = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nva5n6nyns0xp77d1dxng1rjhc8ma6gyd8hczjq3h9qqxcw2q4h";
+      sha256 = "13h65bfbq7hc7z3kqn0m28w9c6ap7fikpjcvsdga6jg01slb4c56";
       type = "gem";
     };
-    version = "1.0.1";
+    version = "1.0.3";
   };
   asciidoctor-diagram-plantuml = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0n018kmqzapf5y1bacb5yyvb9jfwxdkfqnviwxivwz9322b9w6j7";
+      sha256 = "18vbvj9cjr5f63jmjlq9kdknpn2dzykhnrv3i4y5gnbhs6f4jhi2";
       type = "gem";
     };
-    version = "1.2021.8";
+    version = "1.2022.5";
   };
   asciidoctor-epub3 = {
     dependencies = ["asciidoctor" "gepub" "mime-types"];
@@ -121,21 +121,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1372213kxw1b9k120dmyackafzsk80h1y2n0r1hmfrri26kczgfb";
+      sha256 = "1c72ys845dvcfdrgmkzk3zx6d2f1vh8q8fnvyp4rwy6qcvhpjg4d";
       type = "gem";
     };
-    version = "0.0.15";
+    version = "0.0.16";
   };
   asciidoctor-pdf = {
-    dependencies = ["asciidoctor" "concurrent-ruby" "prawn" "prawn-icon" "prawn-svg" "prawn-table" "prawn-templates" "safe_yaml" "treetop"];
+    dependencies = ["asciidoctor" "concurrent-ruby" "matrix" "prawn" "prawn-icon" "prawn-svg" "prawn-table" "prawn-templates" "treetop"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1inl7cykm542jb7a6kraxkgfqn4y3185wrabh5pd5m68rdv56f04";
+      sha256 = "16mw0mlrrx44wn5j2knp3cv7b7phan90y4dr285c1qgdd25310xv";
       type = "gem";
     };
-    version = "1.6.2";
+    version = "2.3.2";
   };
   asciidoctor-revealjs = {
     dependencies = ["asciidoctor" "concurrent-ruby" "thread_safe"];
@@ -164,10 +164,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h4fz93pf96y5syxwpv0vibjf7lidv2718ikpvyd2vy8c1am8zyn";
+      sha256 = "1fy2jrn3gr7cl33qydp3pwyfilcmb4m4z6hfhnvydzg8r3srp36j";
       type = "gem";
     };
-    version = "2.0.3";
+    version = "2.0.4";
   };
   bibtex-ruby = {
     dependencies = ["latex-decode"];
@@ -217,10 +217,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nwad3211p7yv9sda31jmbyw6sdafzmdi2i2niaz6f0wk5nq9h0f";
+      sha256 = "0s4fpn3mqiizpmpy2a24k4v365pv75y50292r8ajrv4i1p5b2k14";
       type = "gem";
     };
-    version = "1.1.9";
+    version = "1.1.10";
   };
   csl = {
     dependencies = ["namae" "rexml"];
@@ -250,10 +250,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qbdgp36dhcyljhmfxrvbgp1ha9yqxhxgyg3sdm48y9m371jd2an";
+      sha256 = "1107j3frhmcd95wcsz0rypchynnzhnjiyyxxcl6dlmr2lfy08z4b";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.12.0";
   };
   gepub = {
     dependencies = ["nokogiri" "rubyzip"];
@@ -282,20 +282,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vdd1kii40qhbr9n8qx71k2gskq6rkl8ygy8hw5hfj8bb5a364xf";
+      sha256 = "1vdcchz7jli1p0gnc669a7bj3q1fv09y9ppf0y3k0vb1jwdwrqwi";
       type = "gem";
     };
-    version = "1.8.11";
+    version = "1.12.0";
   };
   latex-decode = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wnxg82lfkb8bl5la9nmg1434rpkcygygm0ckixjn6ah2dy6i53m";
+      sha256 = "1y5xn3zwghpqr6lvs4s0mn5knms8zw3zk7jb58zkkiagb386nq72";
       type = "gem";
     };
-    version = "0.3.2";
+    version = "0.4.0";
   };
   mathematical = {
     dependencies = ["ruby-enum"];
@@ -308,6 +308,16 @@
     };
     version = "1.6.14";
   };
+  matrix = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1h2cgkpzkh3dd0flnnwfq6f3nl2b1zff9lvqz8xs853ssv5kq23i";
+      type = "gem";
+    };
+    version = "0.4.2";
+  };
   mime-types = {
     dependencies = ["mime-types-data"];
     groups = ["default"];
@@ -334,10 +344,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0d3ga166pahsxavzwj19yjj4lr13rw1vsb36s2qs8blcxigrdp6z";
+      sha256 = "0rapl1sfmfi3bfr68da4ca16yhc0pp93vjwkj7y3rdqrzy3b41hy";
       type = "gem";
     };
-    version = "2.7.1";
+    version = "2.8.0";
   };
   namae = {
     groups = ["default"];
@@ -355,10 +365,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zqzawia52cdcmi55lp7v8jmiqyw7pcpwsksqlnirwfm3f7bnf11";
+      sha256 = "0g7axlq2y6gzmixzzzhw3fn6nhrhg469jj8gfr7gs8igiclpkhkr";
       type = "gem";
     };
-    version = "1.13.1";
+    version = "1.13.8";
   };
   pdf-core = {
     groups = ["default"];
@@ -376,10 +386,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18vsmybpvyi0favlabjipznpc8hgprsm7jpw3s7xr01c3lpjli7y";
+      sha256 = "07chhyxf3qlr65jngns3z5187ibfibf5h2q59505vx45dfr3lvwz";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.10.0";
   };
   polyglot = {
     groups = ["default"];
@@ -451,10 +461,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xqcgkl7bwws1qrlnmxgh8g4g9m10vg60bhlw40fplninb3ng6d9";
+      sha256 = "0sqw1zls6227bgq38sxb2hs8nkdz4hn1zivs27mjbniswfy4zvi6";
       type = "gem";
     };
-    version = "4.0.6";
+    version = "5.0.0";
   };
   "pygments.rb" = {
     groups = ["default"];
@@ -491,10 +501,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0530ri0p60km0bg0ib6swkhfnas427cva7vcdmnwl8df52a10y1k";
+      sha256 = "1dnfkrk8xx2m8r3r9m2p5xcq57viznyc09k7r3i4jbm758i57lx3";
       type = "gem";
     };
-    version = "3.27.0";
+    version = "3.30.0";
   };
   ruby-enum = {
     dependencies = ["i18n"];
@@ -527,16 +537,6 @@
     };
     version = "2.3.2";
   };
-  safe_yaml = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0j7qv63p0vqcd838i2iy2f76c3dgwzkiz1d1xkg7n0pbnxj2vb56";
-      type = "gem";
-    };
-    version = "1.0.5";
-  };
   thread_safe = {
     groups = ["default"];
     platforms = [];
diff --git a/pkgs/tools/typesetting/asciidoctor/Gemfile.lock b/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
index 7652239b998d..e7b6b5c4644b 100644
--- a/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
+++ b/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
@@ -2,27 +2,28 @@ GEM
   remote: https://rubygems.org/
   specs:
     Ascii85 (1.1.0)
-    addressable (2.8.0)
-      public_suffix (>= 2.0.2, < 5.0)
+    addressable (2.8.1)
+      public_suffix (>= 2.0.2, < 6.0)
     afm (0.2.2)
-    asciidoctor (2.0.17)
-    asciidoctor-pdf (1.6.2)
+    asciidoctor (2.0.18)
+    asciidoctor-pdf (2.3.2)
       asciidoctor (~> 2.0)
       concurrent-ruby (~> 1.1)
+      matrix (~> 0.4)
       prawn (~> 2.4.0)
       prawn-icon (~> 3.0.0)
       prawn-svg (~> 0.32.0)
       prawn-table (~> 0.2.0)
       prawn-templates (~> 0.1.0)
-      safe_yaml (~> 1.0.0)
       treetop (~> 1.6.0)
     coderay (1.1.3)
-    concurrent-ruby (1.1.9)
-    css_parser (1.11.0)
+    concurrent-ruby (1.1.10)
+    css_parser (1.12.0)
       addressable
     hashery (2.1.2)
+    matrix (0.4.2)
     pdf-core (0.9.0)
-    pdf-reader (2.8.0)
+    pdf-reader (2.10.0)
       Ascii85 (~> 1.0)
       afm (~> 0.2.1)
       hashery (~> 2.0)
@@ -43,12 +44,11 @@ GEM
     prawn-templates (0.1.2)
       pdf-reader (~> 2.0)
       prawn (~> 2.2)
-    public_suffix (4.0.6)
+    public_suffix (5.0.0)
     pygments.rb (2.3.0)
     rexml (3.2.5)
-    rouge (3.27.0)
+    rouge (4.0.0)
     ruby-rc4 (0.1.5)
-    safe_yaml (1.0.5)
     treetop (1.6.11)
       polyglot (~> 0.3)
     ttfunk (1.7.0)
@@ -64,4 +64,4 @@ DEPENDENCIES
   rouge
 
 BUNDLED WITH
-   2.2.24
+   2.3.22
diff --git a/pkgs/tools/typesetting/asciidoctor/gemset.nix b/pkgs/tools/typesetting/asciidoctor/gemset.nix
index d87c6c1fa995..9c0f96a0b847 100644
--- a/pkgs/tools/typesetting/asciidoctor/gemset.nix
+++ b/pkgs/tools/typesetting/asciidoctor/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "022r3m9wdxljpbya69y2i3h9g3dhhfaqzidf95m6qjzms792jvgp";
+      sha256 = "1ypdmpdn20hxp5vwxz3zc04r5xcwqc25qszdlg41h8ghdqbllwmw";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.8.1";
   };
   afm = {
     groups = ["default"];
@@ -35,21 +35,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g8gn3g6qy4bzjv1b14sj283kqynjgwq62bgq569jr4dkqwmwnzd";
+      sha256 = "11z3vnd8vh3ny1vx69bjrbck5b2g8zsbj94npyadpn7fdp8y3ldv";
       type = "gem";
     };
-    version = "2.0.17";
+    version = "2.0.18";
   };
   asciidoctor-pdf = {
-    dependencies = ["asciidoctor" "concurrent-ruby" "prawn" "prawn-icon" "prawn-svg" "prawn-table" "prawn-templates" "safe_yaml" "treetop"];
+    dependencies = ["asciidoctor" "concurrent-ruby" "matrix" "prawn" "prawn-icon" "prawn-svg" "prawn-table" "prawn-templates" "treetop"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1inl7cykm542jb7a6kraxkgfqn4y3185wrabh5pd5m68rdv56f04";
+      sha256 = "16mw0mlrrx44wn5j2knp3cv7b7phan90y4dr285c1qgdd25310xv";
       type = "gem";
     };
-    version = "1.6.2";
+    version = "2.3.2";
   };
   coderay = {
     groups = ["default"];
@@ -66,10 +66,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nwad3211p7yv9sda31jmbyw6sdafzmdi2i2niaz6f0wk5nq9h0f";
+      sha256 = "0s4fpn3mqiizpmpy2a24k4v365pv75y50292r8ajrv4i1p5b2k14";
       type = "gem";
     };
-    version = "1.1.9";
+    version = "1.1.10";
   };
   css_parser = {
     dependencies = ["addressable"];
@@ -77,10 +77,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qbdgp36dhcyljhmfxrvbgp1ha9yqxhxgyg3sdm48y9m371jd2an";
+      sha256 = "1107j3frhmcd95wcsz0rypchynnzhnjiyyxxcl6dlmr2lfy08z4b";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.12.0";
   };
   hashery = {
     groups = ["default"];
@@ -92,6 +92,16 @@
     };
     version = "2.1.2";
   };
+  matrix = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1h2cgkpzkh3dd0flnnwfq6f3nl2b1zff9lvqz8xs853ssv5kq23i";
+      type = "gem";
+    };
+    version = "0.4.2";
+  };
   pdf-core = {
     groups = ["default"];
     platforms = [];
@@ -108,10 +118,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18vsmybpvyi0favlabjipznpc8hgprsm7jpw3s7xr01c3lpjli7y";
+      sha256 = "07chhyxf3qlr65jngns3z5187ibfibf5h2q59505vx45dfr3lvwz";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.10.0";
   };
   polyglot = {
     groups = ["default"];
@@ -183,10 +193,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xqcgkl7bwws1qrlnmxgh8g4g9m10vg60bhlw40fplninb3ng6d9";
+      sha256 = "0sqw1zls6227bgq38sxb2hs8nkdz4hn1zivs27mjbniswfy4zvi6";
       type = "gem";
     };
-    version = "4.0.6";
+    version = "5.0.0";
   };
   "pygments.rb" = {
     groups = ["default"];
@@ -213,10 +223,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0530ri0p60km0bg0ib6swkhfnas427cva7vcdmnwl8df52a10y1k";
+      sha256 = "066w2wf3mwkzynz9h7qqvvr0w6rq6q45ngjfh9z0s08ny2gpdbmq";
       type = "gem";
     };
-    version = "3.27.0";
+    version = "4.0.0";
   };
   ruby-rc4 = {
     groups = ["default"];
@@ -228,16 +238,6 @@
     };
     version = "0.1.5";
   };
-  safe_yaml = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0j7qv63p0vqcd838i2iy2f76c3dgwzkiz1d1xkg7n0pbnxj2vb56";
-      type = "gem";
-    };
-    version = "1.0.5";
-  };
   treetop = {
     dependencies = ["polyglot"];
     groups = ["default"];
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 94ed0b87362a..6c7d8880a316 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -178,6 +178,18 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
 
   inherit (common) src prePatch;
 
+  patches = [
+    # improves reproducibility of fmt files. This patch has been proposed upstream,
+    # but they are considering some other approaches as well. This is fairly
+    # conservative so we can safely apply it until they make a decision
+    # https://mailman.ntg.nl/pipermail/dev-luatex/2022-April/006650.html
+    (fetchpatch {
+      name = "reproducible_exception_strings.patch";
+      url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1009196;filename=reproducible_exception_strings.patch;msg=5";
+      sha256 = "sha256-RNZoEeTcWnrLaltcYrhNIORh42fFdwMzBfxMRWVurbk=";
+    })
+  ];
+
   hardeningDisable = [ "format" ];
 
   inherit (core) nativeBuildInputs;
diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index c18b7a011a86..c14d8c9f3054 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -50,7 +50,7 @@ in (buildEnv {
     "/tex/generic/config" # make it a real directory for scheme-infraonly
   ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper libfaketime ];
   buildInputs = pkgList.extraInputs;
 
   # This is set primarily to help find-tarballs.nix to do its job
@@ -228,6 +228,21 @@ in (buildEnv {
     FORCE_SOURCE_DATE=1 perl `type -P fmtutil.pl` --sys --all | grep '^fmtutil' # too verbose
     #${bin.texlinks}/bin/texlinks "$out/bin" && wrapBin # do we need to regenerate format links?
 
+    # tex intentionally ignores SOURCE_DATE_EPOCH even when FORCE_SOURCE_DATE=1
+    # https://salsa.debian.org/live-team/live-build/-/blob/master/examples/hooks/reproducible/0139-reproducible-texlive-binaries-fmt-files.hook.chroot#L52
+    if [[ -d share/texmf-var/web2c/tex ]]
+    then
+      cd share/texmf-var/web2c/tex
+      faketime $(date --utc -d@$SOURCE_DATE_EPOCH --iso-8601=seconds) tex -ini -jobname=tex -progname=tex tex.ini
+      cd -
+    fi
+    if [[ -f share/texmf-var/web2c/luahbtex/lualatex.fmt ]]
+    then
+      cd share/texmf-var/web2c/luahbtex
+      faketime $(date --utc -d@$SOURCE_DATE_EPOCH --iso-8601=seconds) luahbtex -ini -jobname=lualatex -progname=lualatex lualatex.ini
+      cd -
+    fi
+
     # Disable unavailable map files
     echo y | perl `type -P updmap.pl` --sys --syncwithtrees --force
     # Regenerate the map files (this is optional)
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 27db30593e88..e58bdde501a6 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -5,6 +5,7 @@
 { stdenv, lib, fetchurl, runCommand, writeText, buildEnv
 , callPackage, ghostscriptX, harfbuzz
 , makeWrapper, python3, ruby, perl, gnused, gnugrep, coreutils
+, libfaketime
 , useFixedHashes ? true
 , recurseIntoAttrs
 }:
@@ -23,7 +24,7 @@ let
   # function for creating a working environment from a set of TL packages
   combine = import ./combine.nix {
     inherit bin combinePkgs buildEnv lib makeWrapper writeText
-      stdenv python3 ruby perl gnused gnugrep coreutils;
+      stdenv python3 ruby perl gnused gnugrep coreutils libfaketime;
     ghostscript = ghostscriptX; # could be without X, probably, but we use X above
   };
 
diff --git a/pkgs/tools/typesetting/xmlto/default.nix b/pkgs/tools/typesetting/xmlto/default.nix
index 4b64c8e97783..5c34ff7554d3 100644
--- a/pkgs/tools/typesetting/xmlto/default.nix
+++ b/pkgs/tools/typesetting/xmlto/default.nix
@@ -27,12 +27,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ libxml2 libxslt docbook_xml_dtd_45 docbook_xsl ];
 
   postInstall = ''
-    wrapProgram "$out/bin/xmlto" \
-       --prefix PATH : "${lib.makeBinPath [ libxslt libxml2 getopt ]}"
-
     # `w3m' is needed for HTML to text conversions.
-    substituteInPlace "$out/share/xmlto/format/docbook/txt" \
-      --replace "/usr/bin/w3m" "${w3m}/bin/w3m"
+    wrapProgram "$out/bin/xmlto" \
+       --prefix PATH : "${lib.makeBinPath [ libxslt libxml2 getopt w3m ]}"
   '';
 
   meta = {
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index d1c4d1035f3f..e9c4a6e40ebb 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -16,7 +16,6 @@ let
       self = localPython;
       packageOverrides = self: super: {
         cement = changeVersion super.cement.overridePythonAttrs "2.8.2" "1li2whjzfhbpg6fjb6r1r92fb3967p1xv6hqs3j787865h2ysrc7";
-        colorama = changeVersion super.colorama.overridePythonAttrs "0.4.3" "189n8hpijy14jfan4ha9f5n06mnl33cxz7ay92wjqgkr639s0vg9";
         future = changeVersion super.future.overridePythonAttrs "0.16.0" "1nzy1k4m9966sikp0qka7lirh8sqrsyainyf8rk97db7nwdfv773";
         wcwidth = changeVersion super.wcwidth.overridePythonAttrs "0.1.9" "1wf5ycjx8s066rdvr0fgz4xds9a8zhs91c4jzxvvymm1c8l8cwzf";
         semantic-version = changeVersion super.semantic-version.overridePythonAttrs "2.8.5" "d2cb2de0558762934679b9a104e82eca7af448c9f4974d1f3eeccff651df8a54";
@@ -52,6 +51,7 @@ with localPython.pkgs; buildPythonApplication rec {
       --replace "requests>=2.20.1,<=2.26" "requests==2.28.1" \
       --replace "botocore>1.23.41,<1.24.0" "botocore>1.23.41,<1.27.76" \
       --replace "pathspec==0.9.0" "pathspec>=0.10.0,<0.11.0" \
+      --replace "colorama>=0.2.5,<0.4.4" "colorama>=0.2.5,<=0.4.6" \
       --replace "termcolor == 1.1.0" "termcolor>=2.0.0,<2.1.0"
   '';
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d69db99ae482..f5fa9a20c4ce 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7375,9 +7375,6 @@ with pkgs;
 
   google-cloud-cpp = callPackage ../development/libraries/google-cloud-cpp {
     openssl = openssl_1_1;
-    abseil-cpp = abseil-cpp.override {
-      cxxStandard = "14";
-    };
   };
 
   google-java-format = callPackage ../development/tools/google-java-format { };
@@ -8762,9 +8759,13 @@ with pkgs;
   nodejs-slim-18_x = callPackage ../development/web/nodejs/v18.nix {
     enableNpm = false;
   };
+  nodejs-19_x = callPackage ../development/web/nodejs/v19.nix { };
+  nodejs-slim-19_x = callPackage ../development/web/nodejs/v19.nix {
+    enableNpm = false;
+  };
   # Update this when adding the newest nodejs major version!
-  nodejs_latest = nodejs-18_x;
-  nodejs-slim_latest = nodejs-slim-18_x;
+  nodejs_latest = nodejs-19_x;
+  nodejs-slim_latest = nodejs-slim-19_x;
 
   nodePackages_latest = dontRecurseIntoAttrs nodejs_latest.pkgs;
 
@@ -10230,6 +10231,11 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) IOKit;
   };
 
+  pcscliteWithPolkit = pcsclite.override {
+    pname = "pcsclite-with-polkit";
+    polkitSupport = true;
+  };
+
   pcsctools = callPackage ../tools/security/pcsctools { };
 
   pcsc-cyberjack = callPackage ../tools/security/pcsc-cyberjack { };
@@ -14571,6 +14577,7 @@ with pkgs;
       /**/ if platform.isDarwin then 11
       else if platform.isFreeBSD then 7
       else if platform.isAndroid then 12
+      else if platform.system == "armv6l-linux" then 7  # This fixes armv6 cross-compilation
       else if platform.isLinux then 11
       else if platform.isWasm then 12
       else latest_version;
@@ -17967,6 +17974,7 @@ with pkgs;
 
   abseil-cpp_202111 = callPackage ../development/libraries/abseil-cpp/202111.nix { };
   abseil-cpp_202103 = callPackage ../development/libraries/abseil-cpp/202103.nix { };
+  abseil-cpp_202206 = callPackage ../development/libraries/abseil-cpp/202206.nix { };
   abseil-cpp = abseil-cpp_202103;
 
   accountsservice = callPackage ../development/libraries/accountsservice { };
@@ -18200,9 +18208,7 @@ with pkgs;
 
   bzrtp = callPackage ../development/libraries/bzrtp { };
 
-  c-ares = callPackage ../development/libraries/c-ares {
-    inherit (buildPackages) cmake;
-  };
+  c-ares = callPackage ../development/libraries/c-ares { };
 
   c-aresMinimal = callPackage ../development/libraries/c-ares {
     withCMake = false;
@@ -19121,7 +19127,7 @@ with pkgs;
 
   grpc = callPackage ../development/libraries/grpc {
     # grpc builds with c++14 so abseil must also be built that way
-    abseil-cpp = abseil-cpp_202111.override {
+    abseil-cpp = abseil-cpp_202206.override {
       cxxStandard = "14";
     };
   };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1cb1cc255951..8043050ade6f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7281,9 +7281,7 @@ self: super: with self; {
   proto-plus = callPackage ../development/python-modules/proto-plus { };
 
   protobuf = callPackage ../development/python-modules/protobuf {
-    disabled = isPyPy;
     # If a protobuf upgrade causes many Python packages to fail, please pin it here to the previous version.
-    doCheck = !isPy3k;
     inherit (pkgs) protobuf;
   };